9 ms·

Smuggling Snowden Secrets

368 points by jbegley 12y ago

soodef_32 12y ago
wow.
deleted 12y ago
[deleted]
- escapologybb 12y ago
  I think this is harsh full stop. This guy had an amazing experience, it was his experience alone and therefore it is his story to tell. He can say whatever he likes, in whatever way he wants and so can you. Isn't the Internet awesome?
  - function_seven 12y ago
    Maybe I don't really want to know, but the comment you're replying to has since been [deleted]. You mind editing yours to share the gist of it?
  - bediger4000 12y ago
    I wonder, just a little bit, if the [deleted] poster, "soodef_32", isn't one of the TLA sockpuppets that we've seen hinted at, the ones that just stir up arguments to make sane people abandon targeted on-line forums.
  - escapologybb 12y ago
    Edit: Reflecting the gist of deleted comment. I think the guy was trying to say that this was a war and that the informationin the article shouldn't have been shared, not just that but there was no real substance to what was shared and that the whole article was basically bragging. Didn't really comment on the substance of what he was saying, other than to say that he was free to say what ever he liked.
davidw 12y ago
I should get back into doing GPG key signings. I really hope that, sometime soonish, someone does a decent browser email crypto thing. It doesn't have to be perfect, it just has to add to the amount of encrypted traffic on the internet.
- atmosx 12y ago
  The problem with GPG integration IMHO is not technical, it's practical: Most people (as it happens with tor) do not understand how it works and more specifically why it should work that way to avoid snooping and MiTM attacks. Until we solve that part, Pretty Good Privacy, won't work for most people. As Einstein said: "Things should be made as simple as possible, but not simpler". By making PGP simpler, you're effectively killing it by adding more and more attack vectors.
  - davidw 12y ago
    Oh, I agree with that wholeheartedly. I bet you could make a 'serious looking' guide like this: https://wiki.debian.org/Keysigning https://wiki.debian.org/Keysigning And add a few instructions like "now email your private key to ..." and people would just go through the motions and do it. Still though, adding to the traffic out there would probably help - at least a little bit - privacy efforts.
    - BillFranklin 12y ago
      Keybase are doing something cool for keysigning - https://keybase.io/ https://keybase.io/
- fossuser 12y ago
  I think Keybase (https://keybase.io/ https://keybase.io/) could really be the answer to this. Once there's a real public key directory and API things can really start to happen on the backend without most users even realizing it.
  - th0br0 12y ago
scintill76 12y ago
> Snowden had forgotten to attach his key, which meant I could not encrypt my response.... His oversight was of no security consequence—it didn’t compromise his identity in any way... Uh, didn't it compromise security by making it possible for someone else to MITM the rest of the emails Snowden received? They see the public key request before he does, send out their key instead, suppress his real response from being sent to them, decrypt mails to him and re-encrypt with his real key so he doesn't notice. AFAICT it indeed didn't compromise his identity, but the privacy and authenticity of the rest of the conversation. Granted, like a lot of MITM scenarios, using crypto at all drastically raises the bar from permitting passive eavesdropping, to requiring a lot of access and agility to eavesdrop. At least, this is my personal, semi-informed conclusion lately -- I don't know what the experts say.
- computer 12y ago
  > Uh, didn't it compromise security by making it possible for someone else to MITM the rest of the emails Snowden received? Yes. The solution is to make him repeat his original message as well, which couldn't have been intercepted because it was encrypted with our own key.
  - mandalar12 12y ago
    No that is not a solution. If they swapped the public key they can read the message being sent back (it is encrypted with their public key), then encrypt it again with the real public key. The only solution is to use another channel to authenticate the other's key, be it GPG's web of trust, or any other imperfect way (phone call, physically meeting, ...)
    - 46e2d5b6 12y ago
      I believe there is an in-band solution to this. First, Agree on a reply latency -- say, 1 day. Then, instead of simply replying to a message, you have an irritating four-step process: 1. Wait until one day after you received the message. 2. Send a digest of the message and your public key. 3. Wait another day. 4. Send the message itself. All that sending would be using PGP. The receiver must make sure that the delays for receiving the digest and the reply body are what the expect. This method requires a MITM to either anticipate what the message is or introduce an extra day of latency, which the receiving would notice.
davidholmesnyc 12y ago
What a great article. To think this guy had no idea for months he was talking to one of the biggest whistleblowers of our generation. Reading this makes me wonder if there's room for a yellow pages style public key directory for journalists. That would of saved a lot of time and hassle.
- rdl 12y ago
  Equally awesome is that he DID know for months he had been talking to one of the biggest whistleblowers of our generation, and he maintained enough OPSEC (i.e. "STFU") that this didn't become widely known.
  - w8rbt 12y ago
    I'm sure you've heard the phrase, "Discretion is the better part of valor". It is good to be brave, however it is also good to be discreet. If you are cautious and discreet (keep your mouth shut and don't brag), you will probably not be put into a situation that requires bravery.
- dmd 12y ago
  > there's room for a yellow pages style public key directory for journalists There is! Most journalists have a Twitter account or at least some verifiable online identity, so that's exactly what https://keybase.io/ https://keybase.io/ is for.
  - davidholmesnyc 12y ago
    Awesome. Didn't know that existed. I have to check it out for my own personal email communications between my friends.
    - deleted 12y ago
      [deleted]
  - na85 12y ago
    Doesn't keybase require you to upload your private keys to them? I can't think of a worse approach.
jordanpg 12y ago
This article highlights for me how much the world could change if the overall knowledge level about PK crypto was raised -- if it became as intuitive for the non-technical user as, say, protecting physical keys.
- th0br0 12y ago
  The issue is that governments would then start to selectively prohibit crypto...
  - Zigurd 12y ago
    Prohibiting strong crypto would create a huge contraband problem. That is, if you wanted to make strong crypto popular and attractive, you could hardly do better than to ban it.
dmix 12y ago
I could imagine the NSA has set up a team of people who collect journalists PGP private keys from their computers these days.
- verytrivial 12y ago
  The article says they went on to set up 'burner' keys, presumably generated on machines the journalists would not be expected to use. Prudent.
  - spacefight 12y ago
    And they tweeted the fingerprints quite often.
deleted 12y ago
[deleted]
GHFigs 12y ago
Glad to see The Intercept is still bringing those hard-hitting revelatory leaks instead of merely capitalizing on public idolization with hagiographic exclusives.
lazaroclapp 12y ago
"The frustrating and ironic thing about GPG is that even experts make mistakes with it. [...] in his first email to me, Snowden had forgotten to attach his key, which meant I could not encrypt my response. I had to send him an unencrypted email asking for his key first." So, not only can't Johny encrypt (http://www.gaudior.net/alma/johnny.pdf http://www.gaudior.net/alma/johnny.pdf), but neither can security experts when their lives may depend on it. Proving once more that not only do we need better security tools, but - above all - more usable security tools.
- corv 12y ago
  We're getting there: https://www.mailpile.is https://www.mailpile.is
  - meapix 12y ago
    From UI perspective, this is already behind.
- beambot 12y ago
  I'm not a security expert.... but shouldn't exchange of the public key happen outside the channel of the message (ie. using a public key / certificate authority)? Otherwise, I could fake the message origination: write my own message, encrypt w/ my private key, and then sending you my public key -- you'd never know the message came from me rather than Snowden. (Could also do a more-sophisticated MITM.)
  - nmjohn 12y ago
    Depends on the situation. An anonymous person contacts you - how do you get their key from a public authority? There is no impersonation attack possible in this case. Someone claiming to be Edward Snowden contacts you today (now that he is longer anonymous) - in this case yes, the author just including their key would not necessarily be secure.
  - lazaroclapp 12y ago
    I guess is an opportunistic encryption vs no-encryption scenario, since Snowden was sending his emails anonymously at that time there was no way for him to verify his identity to anyone. However, this was before there was any attention on him and sending his public key inside his first encrypted email would at least offer guarantees of the form: "If this connection is not MITM'ed now, it cannot become MITM'ed in the future". I suppose Snowden would know if there was indiscriminate and automatic mass-interception of GPG at the time (there might be now). I am also not a crypto expert, but as I understand it: Micah could have also encrypted the email with the key given to him by the 'anonymous mailer', included the hash of that key as part of his message and then signed the whole message with his own key. Since Snowden trusted Micah's key, he could verify the email signature and then check that the included hash matched his own key. A MITM attacker could intercept Snowden's first email and change the key, but then Micah would have hashed the fake key and included that in his email, which the MITM couldn't alter without breaking the signature, then Snowden would have seen the wrong hash on the reply email and know of the presence of the attacker.
minusSeven 12y ago
Great read. This is stuff movies are made of, but in reality its seems more horrifying.
redwaldciei8379 12y ago
0.) Greenwald makes same pattern of mistakes at least 3 times. Get a tainted USB by federal express and get the USB firmware level compromise. Its a common LAZY practice, so ALL USB in Fedex are changed at the central shipping hub. The history is to dissolve glue on envelope and reseal. Today it is automated, perhaps. This is sci fi, of course. 2nd time Greenwald - use your partner to carry the solid state devices. Lead to the 'drug war sweep' at the airport. Yes, your clothes are removed to 'distract you' and to make sure that you are not 'hiding' any USB drives. 3.) There are few 'excellent journalists' left. That's why WE concentrated all of them on da verge as a single point of failure. 4.)Salient fact: there are only 2 techies that know gpg in the org and the journalists dont care to learn or dont know what is important? 5.)three factor authentication == security. 1 factorr eencyrpted key rates low. 6.)xkcd comic badone has hammer on your head and u will give password. a/pple bio-metrics fooled again by latex clone. no 3 is how u play. game: chess 'sing fortissimo' n-q6 (if I play a rank 1600 move, it means REVOKE credentials, a 1900 move means pass) 7.)thought experiment - the radio operator is parachuted into enemy territory. Captured and turned? or maybe... 8.)increas eing the noise to the signal for the metadata is more important.of the h-l or letter h munus 1 which looks like letter l - -pg for 3 letter acronym - is basic. so, twitter source is too low entropy. steagan image or TWO simple texxt on public website forum means plenty oof of downloaders. summary 1.)who are the top 3 in the world? 2.)single point of faliure on one email website? 3.)meta-info ENCRYPTED MESSAGE HIDING plus tor, etc trust attack or even simple denial of service attack leaving only the 'bad ones' to be used. 8.)joke crypto. old Russian proverb. we pretend to work and they pretend to play us ... oops pay us.. yoops slay us? So mister red wald start up the joke contest and have plenty of playing the part of the green herring or is it purple herring - fuscia maybe? - i dunno. THIS WIL INNCREASE THE NOISE TO SIGNAL ratio where bad tyoists yuuppsie TYPISTS are then on the tracking list. Using number theory and the many old people who love to play games and trade joiokes it is now time to look at spam and emails
- adultSwim 12y ago
  0 isn't crazy. Why not interdict all packages going to key government critics? Crazy to think that NSA wouldn't be monitoring journalists to catch their sources.

368 points by jbegley 12y ago

soodef_32 12y ago

wow.

deleted 12y ago

[deleted]

escapologybb 12y ago
I think this is harsh full stop. This guy had an amazing experience, it was his experience alone and therefore it is his story to tell. He can say whatever he likes, in whatever way he wants and so can you. Isn't the Internet awesome?
- function_seven 12y ago
  Maybe I don't really want to know, but the comment you're replying to has since been [deleted]. You mind editing yours to share the gist of it?
- bediger4000 12y ago
  I wonder, just a little bit, if the [deleted] poster, "soodef_32", isn't one of the TLA sockpuppets that we've seen hinted at, the ones that just stir up arguments to make sane people abandon targeted on-line forums.
- escapologybb 12y ago
  Edit: Reflecting the gist of deleted comment. I think the guy was trying to say that this was a war and that the informationin the article shouldn't have been shared, not just that but there was no real substance to what was shared and that the whole article was basically bragging. Didn't really comment on the substance of what he was saying, other than to say that he was free to say what ever he liked.

davidw 12y ago

I should get back into doing GPG key signings. I really hope that, sometime soonish, someone does a decent browser email crypto thing. It doesn't have to be perfect, it just has to add to the amount of encrypted traffic on the internet.

atmosx 12y ago
The problem with GPG integration IMHO is not technical, it's practical: Most people (as it happens with tor) do not understand how it works and more specifically why it should work that way to avoid snooping and MiTM attacks. Until we solve that part, Pretty Good Privacy, won't work for most people. As Einstein said: "Things should be made as simple as possible, but not simpler". By making PGP simpler, you're effectively killing it by adding more and more attack vectors.
- davidw 12y ago
  Oh, I agree with that wholeheartedly. I bet you could make a 'serious looking' guide like this: https://wiki.debian.org/Keysigning https://wiki.debian.org/Keysigning And add a few instructions like "now email your private key to ..." and people would just go through the motions and do it. Still though, adding to the traffic out there would probably help - at least a little bit - privacy efforts.
  - BillFranklin 12y ago
    Keybase are doing something cool for keysigning - https://keybase.io/ https://keybase.io/
fossuser 12y ago
I think Keybase (https://keybase.io/ https://keybase.io/) could really be the answer to this. Once there's a real public key directory and API things can really start to happen on the backend without most users even realizing it.
- th0br0 12y ago

scintill76 12y ago

> Snowden had forgotten to attach his key, which meant I could not encrypt my response.... His oversight was of no security consequence—it didn’t compromise his identity in any way... Uh, didn't it compromise security by making it possible for someone else to MITM the rest of the emails Snowden received? They see the public key request before he does, send out their key instead, suppress his real response from being sent to them, decrypt mails to him and re-encrypt with his real key so he doesn't notice. AFAICT it indeed didn't compromise his identity, but the privacy and authenticity of the rest of the conversation. Granted, like a lot of MITM scenarios, using crypto at all drastically raises the bar from permitting passive eavesdropping, to requiring a lot of access and agility to eavesdrop. At least, this is my personal, semi-informed conclusion lately -- I don't know what the experts say.

computer 12y ago
> Uh, didn't it compromise security by making it possible for someone else to MITM the rest of the emails Snowden received? Yes. The solution is to make him repeat his original message as well, which couldn't have been intercepted because it was encrypted with our own key.
- mandalar12 12y ago
  No that is not a solution. If they swapped the public key they can read the message being sent back (it is encrypted with their public key), then encrypt it again with the real public key. The only solution is to use another channel to authenticate the other's key, be it GPG's web of trust, or any other imperfect way (phone call, physically meeting, ...)
  - 46e2d5b6 12y ago
    I believe there is an in-band solution to this. First, Agree on a reply latency -- say, 1 day. Then, instead of simply replying to a message, you have an irritating four-step process: 1. Wait until one day after you received the message. 2. Send a digest of the message and your public key. 3. Wait another day. 4. Send the message itself. All that sending would be using PGP. The receiver must make sure that the delays for receiving the digest and the reply body are what the expect. This method requires a MITM to either anticipate what the message is or introduce an extra day of latency, which the receiving would notice.

davidholmesnyc 12y ago

What a great article. To think this guy had no idea for months he was talking to one of the biggest whistleblowers of our generation. Reading this makes me wonder if there's room for a yellow pages style public key directory for journalists. That would of saved a lot of time and hassle.

rdl 12y ago
Equally awesome is that he DID know for months he had been talking to one of the biggest whistleblowers of our generation, and he maintained enough OPSEC (i.e. "STFU") that this didn't become widely known.
- w8rbt 12y ago
  I'm sure you've heard the phrase, "Discretion is the better part of valor". It is good to be brave, however it is also good to be discreet. If you are cautious and discreet (keep your mouth shut and don't brag), you will probably not be put into a situation that requires bravery.
dmd 12y ago
> there's room for a yellow pages style public key directory for journalists There is! Most journalists have a Twitter account or at least some verifiable online identity, so that's exactly what https://keybase.io/ https://keybase.io/ is for.
- davidholmesnyc 12y ago
  Awesome. Didn't know that existed. I have to check it out for my own personal email communications between my friends.
  - deleted 12y ago
    [deleted]
- na85 12y ago
  Doesn't keybase require you to upload your private keys to them? I can't think of a worse approach.

jordanpg 12y ago

This article highlights for me how much the world could change if the overall knowledge level about PK crypto was raised -- if it became as intuitive for the non-technical user as, say, protecting physical keys.

th0br0 12y ago
The issue is that governments would then start to selectively prohibit crypto...
- Zigurd 12y ago
  Prohibiting strong crypto would create a huge contraband problem. That is, if you wanted to make strong crypto popular and attractive, you could hardly do better than to ban it.

dmix 12y ago

I could imagine the NSA has set up a team of people who collect journalists PGP private keys from their computers these days.

verytrivial 12y ago
The article says they went on to set up 'burner' keys, presumably generated on machines the journalists would not be expected to use. Prudent.
- spacefight 12y ago
  And they tweeted the fingerprints quite often.

deleted 12y ago

[deleted]

GHFigs 12y ago

Glad to see The Intercept is still bringing those hard-hitting revelatory leaks instead of merely capitalizing on public idolization with hagiographic exclusives.

lazaroclapp 12y ago

"The frustrating and ironic thing about GPG is that even experts make mistakes with it. [...] in his first email to me, Snowden had forgotten to attach his key, which meant I could not encrypt my response. I had to send him an unencrypted email asking for his key first." So, not only can't Johny encrypt (http://www.gaudior.net/alma/johnny.pdf http://www.gaudior.net/alma/johnny.pdf), but neither can security experts when their lives may depend on it. Proving once more that not only do we need better security tools, but - above all - more usable security tools.

corv 12y ago
We're getting there: https://www.mailpile.is https://www.mailpile.is
- meapix 12y ago
  From UI perspective, this is already behind.
beambot 12y ago
I'm not a security expert.... but shouldn't exchange of the public key happen outside the channel of the message (ie. using a public key / certificate authority)? Otherwise, I could fake the message origination: write my own message, encrypt w/ my private key, and then sending you my public key -- you'd never know the message came from me rather than Snowden. (Could also do a more-sophisticated MITM.)
- nmjohn 12y ago
  Depends on the situation. An anonymous person contacts you - how do you get their key from a public authority? There is no impersonation attack possible in this case. Someone claiming to be Edward Snowden contacts you today (now that he is longer anonymous) - in this case yes, the author just including their key would not necessarily be secure.
- lazaroclapp 12y ago
  I guess is an opportunistic encryption vs no-encryption scenario, since Snowden was sending his emails anonymously at that time there was no way for him to verify his identity to anyone. However, this was before there was any attention on him and sending his public key inside his first encrypted email would at least offer guarantees of the form: "If this connection is not MITM'ed now, it cannot become MITM'ed in the future". I suppose Snowden would know if there was indiscriminate and automatic mass-interception of GPG at the time (there might be now). I am also not a crypto expert, but as I understand it: Micah could have also encrypted the email with the key given to him by the 'anonymous mailer', included the hash of that key as part of his message and then signed the whole message with his own key. Since Snowden trusted Micah's key, he could verify the email signature and then check that the included hash matched his own key. A MITM attacker could intercept Snowden's first email and change the key, but then Micah would have hashed the fake key and included that in his email, which the MITM couldn't alter without breaking the signature, then Snowden would have seen the wrong hash on the reply email and know of the presence of the attacker.

minusSeven 12y ago

Great read. This is stuff movies are made of, but in reality its seems more horrifying.

redwaldciei8379 12y ago

0.) Greenwald makes same pattern of mistakes at least 3 times. Get a tainted USB by federal express and get the USB firmware level compromise. Its a common LAZY practice, so ALL USB in Fedex are changed at the central shipping hub. The history is to dissolve glue on envelope and reseal. Today it is automated, perhaps. This is sci fi, of course. 2nd time Greenwald - use your partner to carry the solid state devices. Lead to the 'drug war sweep' at the airport. Yes, your clothes are removed to 'distract you' and to make sure that you are not 'hiding' any USB drives. 3.) There are few 'excellent journalists' left. That's why WE concentrated all of them on da verge as a single point of failure. 4.)Salient fact: there are only 2 techies that know gpg in the org and the journalists dont care to learn or dont know what is important? 5.)three factor authentication == security. 1 factorr eencyrpted key rates low. 6.)xkcd comic badone has hammer on your head and u will give password. a/pple bio-metrics fooled again by latex clone. no 3 is how u play. game: chess 'sing fortissimo' n-q6 (if I play a rank 1600 move, it means REVOKE credentials, a 1900 move means pass) 7.)thought experiment - the radio operator is parachuted into enemy territory. Captured and turned? or maybe... 8.)increas eing the noise to the signal for the metadata is more important.of the h-l or letter h munus 1 which looks like letter l - -pg for 3 letter acronym - is basic. so, twitter source is too low entropy. steagan image or TWO simple texxt on public website forum means plenty oof of downloaders. summary 1.)who are the top 3 in the world? 2.)single point of faliure on one email website? 3.)meta-info ENCRYPTED MESSAGE HIDING plus tor, etc trust attack or even simple denial of service attack leaving only the 'bad ones' to be used. 8.)joke crypto. old Russian proverb. we pretend to work and they pretend to play us ... oops pay us.. yoops slay us? So mister red wald start up the joke contest and have plenty of playing the part of the green herring or is it purple herring - fuscia maybe? - i dunno. THIS WIL INNCREASE THE NOISE TO SIGNAL ratio where bad tyoists yuuppsie TYPISTS are then on the tracking list. Using number theory and the many old people who love to play games and trade joiokes it is now time to look at spam and emails

adultSwim 12y ago
0 isn't crazy. Why not interdict all packages going to key government critics? Crazy to think that NSA wouldn't be monitoring journalists to catch their sources.