4 ms·

Why are we so quick to believe OP's story at face value? There could be factors which led the police to investigate; factors which OP chose not to disclose. T

Why are we so quick to believe OP's story at face value? There could be factors which led the police to investigate; factors which OP chose not to disclose. There is, generally, no way to "brute force" an encrypted container containing child pornography for the simple reason that no one who respects the gravity of the situation would dare choose a password less than 8 characters. Even 8 a-z characters requires (26^8)/2==104.4 billion attempts to bruteforce on average, which is high. Real passwords are likely longer. I realize how flimsy this argument is. They could've chosen a dictionary word as their password, which could indeed be brute forced. All I'm encouraging is for people to think. Turning in evidence of child pornography is the only way that child pornographers will be caught. Having the reaction of "don't go to authorities" will yield a worse society. Is our attitude really to be "fuck society, I'm looking out for myself"?

yeukhon 13y ago
I choose to be on the "dark side" which the majority of the comments here disagree with me. If a police pull you over, don't look for verbal fight. Yes, you should ask "wassup, officer, what's the matter?". But don't start saying "I want a lawyer" if this is some speeding ticket or some ID check. Doing so is stupid - you are wasting police force patrolling. We got a lot of knockout game assault lately. I want more police patrolling. More. Be clever. Just turn on video recorder on your cell phone and walk to the police. If you feel uncomfortable and you feel harassed, sure, use your right and tell the police you want a lawyer. People have always distrust the authority, but ironically they always want more protections. I have dealt with quite a few police officers in my life and I find all of them friendly and reasonable. Just remain clam. Guys have pressures too - getting yell at and middle finger at every single fucking day on the street, worrying the next big time crime comes up at their face and die while enforcing law. Yes, there are some assholes among the polices, but the majority are just everyone else's friend and family. We have assholes in IT, in fire fighters, in the army, in the government, in schools, in everywhere. Whatever reason is behind this "unreasonable searches", let the story reveal on the news then. Let a general attorney get involved. On the other hands, I think it is reasonable for a police to actually ask to check if the contents have been wiped out or not. If you were told X person has decrypted the card and played the videos, you as the state probably want to ensure this content has not been saved in any more device. Yes, sounds stupid, but I think that's reasonable. Think about this - a child was raped and a cracker hacked into X's computer and distributed this file - is that bad? I am not saying the whole questioning family and friend is reasonable, I am not a law enforcer, but the other parts still seem reasonable. -- EDIT -- I actually was a whistleblower myself once. I did the same thing the OP did. I turned in a child pornography evidence. Well, a bunch of people did because this was distributed online. At the time I was just a high school kid and I was managing a popular discussion forum. It was reported by some members on our forum and as a manager I decided to turn this over to the Taiwanese police by pointing them where this source was discovered. I submitted anonymously, however. I still encourage people to be a whistleblower / be a good citizen / good person at some point. We need to arrest these horrible assholes.
DanBC 13y ago
> There is, generally, no way to "brute force" an encrypted container containing child pornography for the simple reason that no one who respects the gravity of the situation would dare choose a password less than 8 characters. Even 8 a-z characters requires (26^8)/2 attempts to bruteforce on average, which is absurdly high. That's just not true. People viewing images of child sexual abuse used to buy access using their credit card - Pete Townsend for one. (Obviously we need to be careful here; lots of crooks were using stolen credit cards). Many people viewing images of child sexual abuse just aren't very good at encryption or anonymity. See "DeAnonymizing alt.anonymous.messages" http://ritter.vg/blog-deanonymizing_amm.html http://ritter.vg/blog-deanonymizing_amm.html > The slides cover the information-theoretic differences between SSL, Onion Routing, Mix Networks, and Shared Mailboxes. It talks about the size of the dataset I analyzed, and some broad percentages of the types of messages in it (PGP vs Non-PGP, Remailed vs Non-Remailed). Then I go into a large analysis of the types of PGP-encrypted messages there are. Messages encrypted to public keys, to passwords and passphrases, and PGP messages not encrypted at all! I strongly agree that turning in the card is the only sensible choice. It's a scary option though.
streetnigga 13y ago
Fuck this, simplicity is the key to many criminal behavioral procedures. Why else avoid a simple license to use a weapon? Lazy. So don't talk about every potential criminal using 2048 strong encryption unless you have something to show for it. This is even disregarding that court cases show lowest hanging fruit caught.
6d0debc071 13y ago
> Even 8 a-z characters requires (26^8)/2==104.4 billion attempts to bruteforce on average, which is high Nu-uh. Small GPU clusters - 25 in the beneath case - get you 300 billion guesses a second, more than sufficient to guess a 26^8 password in a couple of seconds. http://arstechnica.com/security/2012/12/25-gpu-cluster-cracks-every-standard-windows-password-in-6-hours/ http://arstechnica.com/security/2012/12/25-gpu-cluster-crack... He probably only has one GPU working on the problem, but even at as low as a billion guesses a second, you're going to have the password in way less than a day. It's not unreasonable to think that he'd crack it, especially if he just set a computer to working on it for a couple of weeks or so - and I see no reason he wouldn't. Also, nesting encrypted containers was/is something people do to hide file names on passworded zips. Which doesn't inspire confidence in the skills of the defender in this case. I see no reason someone would have done so if they'd used decent encryption, like a truecrypt volume.
aragot 13y ago
That's even assuming the 4chan story is real. Anyone who wwants to spread distrust about police could write it too, and it would be easier than brute-forcing the SD card.

yeukhon 13y ago

I choose to be on the "dark side" which the majority of the comments here disagree with me. If a police pull you over, don't look for verbal fight. Yes, you should ask "wassup, officer, what's the matter?". But don't start saying "I want a lawyer" if this is some speeding ticket or some ID check. Doing so is stupid - you are wasting police force patrolling. We got a lot of knockout game assault lately. I want more police patrolling. More. Be clever. Just turn on video recorder on your cell phone and walk to the police. If you feel uncomfortable and you feel harassed, sure, use your right and tell the police you want a lawyer. People have always distrust the authority, but ironically they always want more protections. I have dealt with quite a few police officers in my life and I find all of them friendly and reasonable. Just remain clam. Guys have pressures too - getting yell at and middle finger at every single fucking day on the street, worrying the next big time crime comes up at their face and die while enforcing law. Yes, there are some assholes among the polices, but the majority are just everyone else's friend and family. We have assholes in IT, in fire fighters, in the army, in the government, in schools, in everywhere. Whatever reason is behind this "unreasonable searches", let the story reveal on the news then. Let a general attorney get involved. On the other hands, I think it is reasonable for a police to actually ask to check if the contents have been wiped out or not. If you were told X person has decrypted the card and played the videos, you as the state probably want to ensure this content has not been saved in any more device. Yes, sounds stupid, but I think that's reasonable. Think about this - a child was raped and a cracker hacked into X's computer and distributed this file - is that bad? I am not saying the whole questioning family and friend is reasonable, I am not a law enforcer, but the other parts still seem reasonable. -- EDIT -- I actually was a whistleblower myself once. I did the same thing the OP did. I turned in a child pornography evidence. Well, a bunch of people did because this was distributed online. At the time I was just a high school kid and I was managing a popular discussion forum. It was reported by some members on our forum and as a manager I decided to turn this over to the Taiwanese police by pointing them where this source was discovered. I submitted anonymously, however. I still encourage people to be a whistleblower / be a good citizen / good person at some point. We need to arrest these horrible assholes.

DanBC 13y ago

> There is, generally, no way to "brute force" an encrypted container containing child pornography for the simple reason that no one who respects the gravity of the situation would dare choose a password less than 8 characters. Even 8 a-z characters requires (26^8)/2 attempts to bruteforce on average, which is absurdly high. That's just not true. People viewing images of child sexual abuse used to buy access using their credit card - Pete Townsend for one. (Obviously we need to be careful here; lots of crooks were using stolen credit cards). Many people viewing images of child sexual abuse just aren't very good at encryption or anonymity. See "DeAnonymizing alt.anonymous.messages" http://ritter.vg/blog-deanonymizing_amm.html http://ritter.vg/blog-deanonymizing_amm.html > The slides cover the information-theoretic differences between SSL, Onion Routing, Mix Networks, and Shared Mailboxes. It talks about the size of the dataset I analyzed, and some broad percentages of the types of messages in it (PGP vs Non-PGP, Remailed vs Non-Remailed). Then I go into a large analysis of the types of PGP-encrypted messages there are. Messages encrypted to public keys, to passwords and passphrases, and PGP messages not encrypted at all! I strongly agree that turning in the card is the only sensible choice. It's a scary option though.

streetnigga 13y ago

Fuck this, simplicity is the key to many criminal behavioral procedures. Why else avoid a simple license to use a weapon? Lazy. So don't talk about every potential criminal using 2048 strong encryption unless you have something to show for it. This is even disregarding that court cases show lowest hanging fruit caught.

6d0debc071 13y ago

> Even 8 a-z characters requires (26^8)/2==104.4 billion attempts to bruteforce on average, which is high Nu-uh. Small GPU clusters - 25 in the beneath case - get you 300 billion guesses a second, more than sufficient to guess a 26^8 password in a couple of seconds. http://arstechnica.com/security/2012/12/25-gpu-cluster-cracks-every-standard-windows-password-in-6-hours/ http://arstechnica.com/security/2012/12/25-gpu-cluster-crack... He probably only has one GPU working on the problem, but even at as low as a billion guesses a second, you're going to have the password in way less than a day. It's not unreasonable to think that he'd crack it, especially if he just set a computer to working on it for a couple of weeks or so - and I see no reason he wouldn't. Also, nesting encrypted containers was/is something people do to hide file names on passworded zips. Which doesn't inspire confidence in the skills of the defender in this case. I see no reason someone would have done so if they'd used decent encryption, like a truecrypt volume.

aragot 13y ago

That's even assuming the 4chan story is real. Anyone who wwants to spread distrust about police could write it too, and it would be easier than brute-forcing the SD card.