5 ms·

More likely is that the Snowden documents have been widely distributed in encrypted form (as one of the Wikileaks insurance releases) and Russia/China have mana

by UVB-76 11y ago

More likely is that the Snowden documents have been widely distributed in encrypted form (as one of the Wikileaks insurance releases) and Russia/China have managed to brute force the key.

scotchmi_st 11y ago
That broadly speaking comes under point 1, and in my opinion, that's very unlikely, given that at the point Snowden stopped contracting for the NSA, PGP was still considered uncrackable by them.
lawnchair_larry 11y ago
This is least likely.
- ryan-c 11y ago
  Snowden's passphrase[0] advice is pretty bad - perhaps they came up with a list of phrases based on what they know of him and successfully cracked it. > “The best advice here is to shift your thinking from passWORDs to passPHRASES,” Snowden recommended. “Think about a common phrase that works for you. It’s too long to brute force and also make them unlikely to be in the dictionary.” (emphasis mine) 0. http://rt.com/usa/248401-snowden-oliver-password-protection-advice/ http://rt.com/usa/248401-snowden-oliver-password-protection-...
  - programmernews3 11y ago
    I expect Snowden actually advocates people use something like diceware passphrases and the journalist misunderstood. https://en.wikipedia.org/wiki/Diceware https://en.wikipedia.org/wiki/Diceware
    - ryan-c 11y ago
      That sure isn't what he said to John Oliver. https://www.youtube.com/watch?v=yzGzB-yYKcc#t=1m30s https://www.youtube.com/watch?v=yzGzB-yYKcc#t=1m30s He mentioned "margrattethatcheris110%SEXY" - I would be totally unsuprised if someone managed to crack that. Diceware is a great choice.
  - anonbanker 11y ago
    Perhaps you can come up with a reason why this is bad? While I'm asking, perhaps you can come up with a reason that doesn't boil down to "Bruce Schneirer said XKCD method was bad"?
    - ryan-c 11y ago
      It's more that most humans are predictable most of the time. There's no reason a password cracking dictionary can't contain phrases as well, and most of the sorts of rules based permutations used against normal passwords can be extended to passphrases. Attacking a specific individual also tends to be easier - you can profile them and build targeted word and phrase lists. XKCD is bad specifically because it is specifically talking about attacking a password via an internet based oracle rather than attacking a hash, but people generalized it. A search space of ten or twenty trillion is laughable when a few GPUs can make a billions of guesses per second against a vanilla hash algorithm. Ultimately, if you want a password or passphrase that a computer can't guess, you should let a computer pick it for you, or if you're really paranoid, use diceware.
Sideloader 11y ago
Most likely? Any evidence to back up that claim?

by UVB-76 11y ago

More likely is that the Snowden documents have been widely distributed in encrypted form (as one of the Wikileaks insurance releases) and Russia/China have managed to brute force the key.

scotchmi_st 11y ago

That broadly speaking comes under point 1, and in my opinion, that's very unlikely, given that at the point Snowden stopped contracting for the NSA, PGP was still considered uncrackable by them.

lawnchair_larry 11y ago

This is least likely.

ryan-c 11y ago
Snowden's passphrase[0] advice is pretty bad - perhaps they came up with a list of phrases based on what they know of him and successfully cracked it. > “The best advice here is to shift your thinking from passWORDs to passPHRASES,” Snowden recommended. “Think about a common phrase that works for you. It’s too long to brute force and also make them unlikely to be in the dictionary.” (emphasis mine) 0. http://rt.com/usa/248401-snowden-oliver-password-protection-advice/ http://rt.com/usa/248401-snowden-oliver-password-protection-...
- programmernews3 11y ago
  I expect Snowden actually advocates people use something like diceware passphrases and the journalist misunderstood. https://en.wikipedia.org/wiki/Diceware https://en.wikipedia.org/wiki/Diceware
  - ryan-c 11y ago
    That sure isn't what he said to John Oliver. https://www.youtube.com/watch?v=yzGzB-yYKcc#t=1m30s https://www.youtube.com/watch?v=yzGzB-yYKcc#t=1m30s He mentioned "margrattethatcheris110%SEXY" - I would be totally unsuprised if someone managed to crack that. Diceware is a great choice.
- anonbanker 11y ago
  Perhaps you can come up with a reason why this is bad? While I'm asking, perhaps you can come up with a reason that doesn't boil down to "Bruce Schneirer said XKCD method was bad"?
  - ryan-c 11y ago
    It's more that most humans are predictable most of the time. There's no reason a password cracking dictionary can't contain phrases as well, and most of the sorts of rules based permutations used against normal passwords can be extended to passphrases. Attacking a specific individual also tends to be easier - you can profile them and build targeted word and phrase lists. XKCD is bad specifically because it is specifically talking about attacking a password via an internet based oracle rather than attacking a hash, but people generalized it. A search space of ten or twenty trillion is laughable when a few GPUs can make a billions of guesses per second against a vanilla hash algorithm. Ultimately, if you want a password or passphrase that a computer can't guess, you should let a computer pick it for you, or if you're really paranoid, use diceware.

Sideloader 11y ago

Most likely? Any evidence to back up that claim?