5 ms·

Honest question: is it poor logic or not that I tend to believe these slides are truly from the government they are supposed to be from based solely on how larg

by MWil 13y ago

Honest question: is it poor logic or not that I tend to believe these slides are truly from the government they are supposed to be from based solely on how large of an eyesore the design is? However, surely by now people like Glen Greenwald have heard such feedback so if someone from the other side of the aisle wanted to reverse false flag they would just use atrocious designs. However, now the govt. has read THIS, so I clearly cannot choose the cup in front of me...

rdl 13y ago
I assume he is depending on the provenance marker that these are part of a big pile of documents provided by Snowden.
- MWil 13y ago
  just so we're clear, what is the provenance marker specifically in these slides? I'm seeing .pngs when I click the slides where, if I was thinking there's a proveable origin, it would be a digitally signed pdf or something like what the GPO (government printing office) uses, but for secret things of course...
  - rdl 13y ago
    That Snowden handed it to you is the provenance marker. He claims to have jacked a whole bunch of shit from NSA, and has given no one particular reason to doubt him. If this is one file on media which he handed GG back in May 2013, GG has good reason to believe it was in fact jacked from NSA by Snowden. Falsification would be a lot more likely if anyone handed you docs after Snowden went public, but before it was public, it was either a set up (by Snowden), or pretty strongly authenticated. The arrow of time cannot be defeated.
    - MWil 13y ago
      I'm talking about from MY or YOUR perspective. Let's first set up the stage: -Snowden hands you paper/digital files, possibly with no trail that you can verify (besides govt. acknowledgment of any specific document) - You (likely) immediately make (many) digital copies, this is a trail others can verify later - like with an md5 sum or something (not my forte, obviously). - Before you assist with releasing the whole cache and risk another wikileaks-style attack for not being more sensitive to the content in each document, you start the long process of reviewing each document. - You find acceptable publications - You publish the documents from step 2 (which have a digital trail to verify they were handed to GG from Snowden at the time they say they were) That last step hasn't happened as far as I know, we're getting pictures of documents...
      - rdl 13y ago
        From what Schneier and others have published, the documents are being handled in an offline "data room" way. You do have to trust both Snowden and some subset of {Greenwald, Poitras, Unindicted co-conspirators in Berlin}, but I don't see any particular reason not to do so in this case.
        MWil 13y ago
        I'll hold off until I learn more about the way they've set that up then. Surely, they've been transparent about it and haven't just said "we do it in an offline data room way." I could google but if you wouldn't mind linking anything you might have offhand in that regard, I'd appreciate it.
        rdl 13y ago
        https://www.schneier.com/blog/archives/2013/10/air_gaps.html https://www.schneier.com/blog/archives/2013/10/air_gaps.html
        MWil 13y ago
        "never directly connect it to the Internet again" but not, "never directly connect it to the Internet"? Seems odd to me since you can use the same air-gap to configure the computer for your needs in the first place instead of turning a networked computer into an air-gapped one. "But for Windows full-disk encryption it's that..." But not an open-source operating system with access to the exact same security solutions? Why isn't using Tails or other Linux something that's at a minimum instead of a "you could if you like". No mention of better air-gapping the computer by keeping modules attached to the motherboard to a minimum (usb cd-drives, removable 3.5" media readers). Overall: I am by no means a security expert, but as a lawyer who has to do due diligence on cloud providers (most fail as far as what they advertise or in being truly eligible), I would consider his described setup as very weak if the motive that makes you consider air-gapping in the first place is your first priority. It seems more like his second or third priority...
Crito 13y ago
One would think that if the documents were fabrications, they would be dismissed as such by the people and organizations that they indict. I mean, I could fabricate documents that detail how the moon landing was faked, but I would be called out on my fabrication immediately. In this case however the only people floating the "the documents are fake" theory are third parties with no unique insight into the allegations, notably not the accused.
- MWil 13y ago
  That's not really true b/c even leaked to the public top secret documents remain top secret in government circles. It's why government employees are specifically told not to seek out wikileaks or snowden documents - you can't gain "legitimate" access to those documents through the public. Unless through all the noise I've missed where the govt. has said this or that document in particular is in fact genuine. I'm not saying it hasn't happened but I haven't seen it. Even acknowledgement of a program (PRISM, for example) isn't acknowledgement of PRISM slide #4, although it does make it's authenticity more likely than not.
  - rdl 13y ago
    Counterintelligence people are still allowed to look at the leaked documents, and (through the proper channels) make statements about them. It's the rank-and-file people who aren't supposed to look at this stuff, and that's mainly to avoid two things: 1) Disclosing additional information, or inadvertently attesting to the validity of documents. (obvious attack: release two plausible contradictory "top secret" documents" which cover the whole space you care about; when people discredit one, you have strong evidence of the latter.) 2) Complicating later CI investigations -- if MAJ Snuffy has downloaded wikileaks docs onto his personal laptop, and a scan finds a bunch of TS/NOFORNicate documents on it (heh), it will be a false positive. If SSG Evil wants to exfiltrate documents, she can just fill a laptop with wikileaks stuff and her own documents and then, if caught, claim it was just wikileaks downloads. But CI investigators are allowed to touch this stuff. Just like some FBI people see child porn all the time (which has to be one of the shittiest jobs in infosec).
  - Crito 13y ago
anigbrowl 13y ago
If you think the slides are bad now, try digesting them on government coffee.

by MWil 13y ago

rdl 13y ago

I assume he is depending on the provenance marker that these are part of a big pile of documents provided by Snowden.

MWil 13y ago
just so we're clear, what is the provenance marker specifically in these slides? I'm seeing .pngs when I click the slides where, if I was thinking there's a proveable origin, it would be a digitally signed pdf or something like what the GPO (government printing office) uses, but for secret things of course...
- rdl 13y ago
  That Snowden handed it to you is the provenance marker. He claims to have jacked a whole bunch of shit from NSA, and has given no one particular reason to doubt him. If this is one file on media which he handed GG back in May 2013, GG has good reason to believe it was in fact jacked from NSA by Snowden. Falsification would be a lot more likely if anyone handed you docs after Snowden went public, but before it was public, it was either a set up (by Snowden), or pretty strongly authenticated. The arrow of time cannot be defeated.
  - MWil 13y ago
    I'm talking about from MY or YOUR perspective. Let's first set up the stage: -Snowden hands you paper/digital files, possibly with no trail that you can verify (besides govt. acknowledgment of any specific document) - You (likely) immediately make (many) digital copies, this is a trail others can verify later - like with an md5 sum or something (not my forte, obviously). - Before you assist with releasing the whole cache and risk another wikileaks-style attack for not being more sensitive to the content in each document, you start the long process of reviewing each document. - You find acceptable publications - You publish the documents from step 2 (which have a digital trail to verify they were handed to GG from Snowden at the time they say they were) That last step hasn't happened as far as I know, we're getting pictures of documents...
    - rdl 13y ago
      From what Schneier and others have published, the documents are being handled in an offline "data room" way. You do have to trust both Snowden and some subset of {Greenwald, Poitras, Unindicted co-conspirators in Berlin}, but I don't see any particular reason not to do so in this case.
      - MWil 13y ago
        I'll hold off until I learn more about the way they've set that up then. Surely, they've been transparent about it and haven't just said "we do it in an offline data room way." I could google but if you wouldn't mind linking anything you might have offhand in that regard, I'd appreciate it.
        rdl 13y ago
        https://www.schneier.com/blog/archives/2013/10/air_gaps.html https://www.schneier.com/blog/archives/2013/10/air_gaps.html
        MWil 13y ago
        "never directly connect it to the Internet again" but not, "never directly connect it to the Internet"? Seems odd to me since you can use the same air-gap to configure the computer for your needs in the first place instead of turning a networked computer into an air-gapped one. "But for Windows full-disk encryption it's that..." But not an open-source operating system with access to the exact same security solutions? Why isn't using Tails or other Linux something that's at a minimum instead of a "you could if you like". No mention of better air-gapping the computer by keeping modules attached to the motherboard to a minimum (usb cd-drives, removable 3.5" media readers). Overall: I am by no means a security expert, but as a lawyer who has to do due diligence on cloud providers (most fail as far as what they advertise or in being truly eligible), I would consider his described setup as very weak if the motive that makes you consider air-gapping in the first place is your first priority. It seems more like his second or third priority...

Crito 13y ago

One would think that if the documents were fabrications, they would be dismissed as such by the people and organizations that they indict. I mean, I could fabricate documents that detail how the moon landing was faked, but I would be called out on my fabrication immediately. In this case however the only people floating the "the documents are fake" theory are third parties with no unique insight into the allegations, notably not the accused.

MWil 13y ago
That's not really true b/c even leaked to the public top secret documents remain top secret in government circles. It's why government employees are specifically told not to seek out wikileaks or snowden documents - you can't gain "legitimate" access to those documents through the public. Unless through all the noise I've missed where the govt. has said this or that document in particular is in fact genuine. I'm not saying it hasn't happened but I haven't seen it. Even acknowledgement of a program (PRISM, for example) isn't acknowledgement of PRISM slide #4, although it does make it's authenticity more likely than not.
- rdl 13y ago
  Counterintelligence people are still allowed to look at the leaked documents, and (through the proper channels) make statements about them. It's the rank-and-file people who aren't supposed to look at this stuff, and that's mainly to avoid two things: 1) Disclosing additional information, or inadvertently attesting to the validity of documents. (obvious attack: release two plausible contradictory "top secret" documents" which cover the whole space you care about; when people discredit one, you have strong evidence of the latter.) 2) Complicating later CI investigations -- if MAJ Snuffy has downloaded wikileaks docs onto his personal laptop, and a scan finds a bunch of TS/NOFORNicate documents on it (heh), it will be a false positive. If SSG Evil wants to exfiltrate documents, she can just fill a laptop with wikileaks stuff and her own documents and then, if caught, claim it was just wikileaks downloads. But CI investigators are allowed to touch this stuff. Just like some FBI people see child porn all the time (which has to be one of the shittiest jobs in infosec).
- Crito 13y ago

anigbrowl 13y ago

If you think the slides are bad now, try digesting them on government coffee.