12 ms·

Meanwhile the way Bruce Schneier is now using GPG is really only one conceptual leap away from full-blown Tinfoil Hat Linux usage: http://en.wikipedia.org/wiki/

by jlgreco 13y ago

Meanwhile the way Bruce Schneier is now using GPG is really only one conceptual leap away from full-blown Tinfoil Hat Linux usage: http://en.wikipedia.org/wiki/Tinfoil_Hat_Linux http://en.wikipedia.org/wiki/Tinfoil_Hat_Linux The difference between "tinfoil hatters" and reasonable people like Bruce Schneier now seems to be how concerned they are with their ability to destroy a harddrive, and TEMPEST.

sillysaurus2 13y ago
the way Bruce Schneier is now using GPG Which way is that? Also, from your Tinfoil Hat Linux link, this idea is hilariously awesome: Keystroke monitoring — THL has gpggrid, a wrapper for GPG that lets you use a video game style character entry system instead of typing in your passphrase. Keystroke loggers get a set of grid points, not your passphrase. I wonder if it might be possible to implement that idea into other operating systems?
- MacsHeadroom 13y ago
  >Which way is that? https://www.schneier.com/contact.html https://www.schneier.com/contact.html All default settings, except the 4096-bit key length. See: https://www.schneier.com/blog/archives/2013/09/my_new_gpgpgp_a.html https://www.schneier.com/blog/archives/2013/09/my_new_gpgpgp...
- jlgreco 13y ago
  Air gapped with new hardware: "Since I started working with the Snowden documents, I bought a new computer that has never been connected to the internet. If I want to transfer a file, I encrypt the file on the secure computer and walk it over to my internet computer, using a USB stick. To decrypt something, I reverse the process. This might not be bulletproof, but it's pretty good." http://www.theguardian.com/world/2013/sep/05/nsa-how-to-remain-secure-surveillance http://www.theguardian.com/world/2013/sep/05/nsa-how-to-rema... Air gapping is certainly not unprecedented, but individuals using it have traditionally been considered pretty "tinfoil-y". edit: "I wonder if it might be possible to implement that idea into other operating systems?" gpggrid itself could probably just be built on any other Linux install. Certainly it could be recreated. One of the neat features of TFL that I really like is the idea of blinking LEDs on the users keyboard instead of displaying things on screen. Effective? Who knows... but certainly amusing.
  - Amadou 13y ago
    IF he was serious he would be burning CDs/DVDs instead of using a read-write USB stick. It is tedious, but blank media is cheap and there is precedent (that I'm sure Bruce is aware of): The DoD's own (classified) SIPRNet was infiltrated via a flash-drive based virus back in 2008. http://www.washingtonpost.com/wp-dyn/content/article/2010/08/24/AR2010082406154.html http://www.washingtonpost.com/wp-dyn/content/article/2010/08...
    - 205guy 13y ago
      I kinda thought the same thing about flash-drive viruses, and why Bruce wasn't using CDs/DVDs instead. Then I realized if he was really serious, he wouldn't say what he's really using, and he'd have a USB honeypot plugged into his network-facing computer.
      - Groxx 13y ago
        Named "Iocane Powder" of course.
        officialjunk 13y ago
        "i'd bet my life on it..."
      - jasomill 13y ago
        Note that he didn't say what software he's running on the new air-gapped computer. The difference between locking down one air-gapped PC running only software required for encryption and locking down the entire network of PCs running the wide variety of software required to do everything everyone needs to do on the SIPRnet is huge.
    - enneff 13y ago
      Another approach might be to set up an old-fashioned serial link between the machines. It's easy enough to observe and audit all the traffic that passes through a serial cable.
    - 13y ago
- quantumpotato_ 13y ago
  Julian Assange worked on projects relating to maze navigation, theorizing that people could memorize the muscle sequences but not be able to tell them under pressure, or fail under pressure. Randomizing the position of landmarks eg. go to A, B, E, C, F, then showing a map could let the user enter a different sequence of keystrokes to get the same result.
tptacek 13y ago
You mean changing the number of "2048" to "4096"? I'm not sold on that being a meaningful improvement to his security, but even so, you realize that change costs him nothing, right? He needed to generate a new key... why not set it to 4096 bits? Everything he does with that key happens in human scale time --- even a 500ms per message delay wouldn't be noticeable. So, some evocatively named Linux distro recommends the same key size, is what I understand you to be saying, and therefore... what? Aliens really did land at Roswell?
- wslh 13y ago
  I am using 8192 bits, just in case ;-) also applying one time pads when I can.
  - mithras 13y ago
    How do you get the one time pad to the recipient?
    - wslh 13y ago
      Personally.
      - samstave 13y ago
        Just out of curiosity - assume you took a key of 8096 bits - and it is super long - could you then make a hash of the key which were shorter, and provide the hash, with instructions on how to reverse it, and then use the hash to produce the 8096 keylength with less digits between you and the recipient?
        tptacek 13y ago
        Are you asking whether you can compress an RSA key? Anyways: don't use 8192 bit keys. Whatever kills the 4096 bit keys is going to kill RSA along with them. Honestly, I think 4096 bits is also kind of a you're-kidding-yourself key length; if attacks on 2048 bit keys became tractable, RSA is probably in serious trouble.
diminoten 13y ago
Bruce Schneier is not a reasonable person about his own computer security any more than a virologist is a reasonable person over her own infectivity. He knows too much to be a reasonable person.
- jlgreco 13y ago
  Surely a virologist can be considered more reasonable about related matters of personal than the general public (who cannot even be trusted to immunize themselves or their children, and cannot be trusted to trust modern medicine instead of roots some hippy pulled out of the ground behind their shed). Bruce isn't a nutter. I don't think many people would actually argue otherwise.

by jlgreco 13y ago

sillysaurus2 13y ago

the way Bruce Schneier is now using GPG Which way is that? Also, from your Tinfoil Hat Linux link, this idea is hilariously awesome: Keystroke monitoring — THL has gpggrid, a wrapper for GPG that lets you use a video game style character entry system instead of typing in your passphrase. Keystroke loggers get a set of grid points, not your passphrase. I wonder if it might be possible to implement that idea into other operating systems?

MacsHeadroom 13y ago
>Which way is that? https://www.schneier.com/contact.html https://www.schneier.com/contact.html All default settings, except the 4096-bit key length. See: https://www.schneier.com/blog/archives/2013/09/my_new_gpgpgp_a.html https://www.schneier.com/blog/archives/2013/09/my_new_gpgpgp...
jlgreco 13y ago
Air gapped with new hardware: "Since I started working with the Snowden documents, I bought a new computer that has never been connected to the internet. If I want to transfer a file, I encrypt the file on the secure computer and walk it over to my internet computer, using a USB stick. To decrypt something, I reverse the process. This might not be bulletproof, but it's pretty good." http://www.theguardian.com/world/2013/sep/05/nsa-how-to-remain-secure-surveillance http://www.theguardian.com/world/2013/sep/05/nsa-how-to-rema... Air gapping is certainly not unprecedented, but individuals using it have traditionally been considered pretty "tinfoil-y". edit: "I wonder if it might be possible to implement that idea into other operating systems?" gpggrid itself could probably just be built on any other Linux install. Certainly it could be recreated. One of the neat features of TFL that I really like is the idea of blinking LEDs on the users keyboard instead of displaying things on screen. Effective? Who knows... but certainly amusing.
- Amadou 13y ago
  IF he was serious he would be burning CDs/DVDs instead of using a read-write USB stick. It is tedious, but blank media is cheap and there is precedent (that I'm sure Bruce is aware of): The DoD's own (classified) SIPRNet was infiltrated via a flash-drive based virus back in 2008. http://www.washingtonpost.com/wp-dyn/content/article/2010/08/24/AR2010082406154.html http://www.washingtonpost.com/wp-dyn/content/article/2010/08...
  - 205guy 13y ago
    I kinda thought the same thing about flash-drive viruses, and why Bruce wasn't using CDs/DVDs instead. Then I realized if he was really serious, he wouldn't say what he's really using, and he'd have a USB honeypot plugged into his network-facing computer.
    - Groxx 13y ago
      Named "Iocane Powder" of course.
      - officialjunk 13y ago
        "i'd bet my life on it..."
    - jasomill 13y ago
      Note that he didn't say what software he's running on the new air-gapped computer. The difference between locking down one air-gapped PC running only software required for encryption and locking down the entire network of PCs running the wide variety of software required to do everything everyone needs to do on the SIPRnet is huge.
  - enneff 13y ago
    Another approach might be to set up an old-fashioned serial link between the machines. It's easy enough to observe and audit all the traffic that passes through a serial cable.
  - 13y ago
quantumpotato_ 13y ago
Julian Assange worked on projects relating to maze navigation, theorizing that people could memorize the muscle sequences but not be able to tell them under pressure, or fail under pressure. Randomizing the position of landmarks eg. go to A, B, E, C, F, then showing a map could let the user enter a different sequence of keystrokes to get the same result.

tptacek 13y ago

You mean changing the number of "2048" to "4096"? I'm not sold on that being a meaningful improvement to his security, but even so, you realize that change costs him nothing, right? He needed to generate a new key... why not set it to 4096 bits? Everything he does with that key happens in human scale time --- even a 500ms per message delay wouldn't be noticeable. So, some evocatively named Linux distro recommends the same key size, is what I understand you to be saying, and therefore... what? Aliens really did land at Roswell?

wslh 13y ago
I am using 8192 bits, just in case ;-) also applying one time pads when I can.
- mithras 13y ago
  How do you get the one time pad to the recipient?
  - wslh 13y ago
    Personally.
    - samstave 13y ago
      Just out of curiosity - assume you took a key of 8096 bits - and it is super long - could you then make a hash of the key which were shorter, and provide the hash, with instructions on how to reverse it, and then use the hash to produce the 8096 keylength with less digits between you and the recipient?
      - tptacek 13y ago
        Are you asking whether you can compress an RSA key? Anyways: don't use 8192 bit keys. Whatever kills the 4096 bit keys is going to kill RSA along with them. Honestly, I think 4096 bits is also kind of a you're-kidding-yourself key length; if attacks on 2048 bit keys became tractable, RSA is probably in serious trouble.

diminoten 13y ago

Bruce Schneier is not a reasonable person about his own computer security any more than a virologist is a reasonable person over her own infectivity. He knows too much to be a reasonable person.

jlgreco 13y ago
Surely a virologist can be considered more reasonable about related matters of personal than the general public (who cannot even be trusted to immunize themselves or their children, and cannot be trusted to trust modern medicine instead of roots some hippy pulled out of the ground behind their shed). Bruce isn't a nutter. I don't think many people would actually argue otherwise.