Smuggling Snowden Secrets

https://firstlook.org/theintercept/2014/10/28/smuggling-snowden-secrets/

by jbegley • 12 years ago

368 60 12 years ago

davidw2• 12 years ago

I should get back into doing GPG key signings. I really hope that, sometime soonish, someone does a decent browser email crypto thing. It doesn't have to be perfect, it just has to add to the amount of encrypted traffic on the internet.

atmosx• 12 years ago

The problem with GPG integration IMHO is not technical, it's practical: Most people (as it happens with tor) do not understand how it works and more specifically why it should work that way to avoid snooping and MiTM attacks. Until we solve that part, Pretty Good Privacy, won't work for most people.

As Einstein said: "Things should be made as simple as possible, but not simpler". By making PGP simpler, you're effectively killing it by adding more and more attack vectors.

davidw2• 12 years ago

Oh, I agree with that wholeheartedly. I bet you could make a 'serious looking' guide like this:

https://wiki.debian.org/Keysigning

And add a few instructions like "now email your private key to ..." and people would just go through the motions and do it.

Still though, adding to the traffic out there would probably help - at least a little bit - privacy efforts.

gonehome2• 12 years ago

I think Keybase (https://keybase.io/) could really be the answer to this. Once there's a real public key directory and API things can really start to happen on the backend without most users even realizing it.

th0br02• 12 years ago

They recommend you to upload your _private_ key to their servers though! (Ok, encrypted with scrypt... but still...) ... a very bad thing to recommend users to do.

dllthomas5• 12 years ago

One thing that worries me about GPG's trust model is that marginal trust doesn't actually stack very well. If three of my friends go to a key signing party, and each check some guy's ID to his face, I'm not really that much more confident that it wasn't a fake ID. The same holds, albeit weaker, over more spread out interactions... Only signing keys when I've known the person interacting in public under that identity for a protracted time seems a solution, but dramatically limits the growth of the network.

DanBC• 12 years ago

There's a well known problem with manufacturing inspction called "the two inspector problem".

Ann ispects units, then hands them on to Bob who performs a final inspection. Ann is falling behind so she gives the units a quick short less thorough inspection. She knows that Bob will catch the problem. Bob gets a sudden extra load of units, so he too gives them a less rigorous inspection. Bob knows that Ann has previously inspected them. It happens surprisingly often although not quite in that form.

There's a whole bunch of research shwoing what a group of people do when estimating numbers - they tend to clump around whatthe first person says.

I suspect three people checking and ID would be subject to both of these problems.

acqq4• 12 years ago

Very problematic is the potential of signers spam. Imagine people who blindly sign the keys only to appear listed when somebody looks for somebody well-known. Imagine ads in PGP keys.

kyboren2• 12 years ago

You can cryptographically verify any biometric passport (all Visa Waiver Program countries have them) and most European ID cards with any NFC-capable Android smartphone. They include the holder's name and picture and are signed by the government-controlled CA for that country's identity documents.

A_COMPUTER• 12 years ago

I am not sure, but I think that an implicit goal of keysigning is to: one, get any chain at all between two people for the more common case of no chain compared to the rarer case of active malice; and two, if enough people do it the graph should reveal impostors or at least a discrepancy that can be investigated. Someone may not realize there's a fake key out there with their name on it until a bunch of people start signing each others keys and uploading the wad of signatures to keyservers.

scintill76• 12 years ago

Snowden had forgotten to attach his key, which meant I could not encrypt my response.... His oversight was of no security consequence—it didn’t compromise his identity in any way...

Uh, didn't it compromise security by making it possible for someone else to MITM the rest of the emails Snowden received? They see the public key request before he does, send out their key instead, suppress his real response from being sent to them, decrypt mails to him and re-encrypt with his real key so he doesn't notice. AFAICT it indeed didn't compromise his identity, but the privacy and authenticity of the rest of the conversation.

Granted, like a lot of MITM scenarios, using crypto at all drastically raises the bar from permitting passive eavesdropping, to requiring a lot of access and agility to eavesdrop. At least, this is my personal, semi-informed conclusion lately -- I don't know what the experts say.

computer2• 12 years ago

Uh, didn't it compromise security by making it possible for someone else to MITM the rest of the emails Snowden received?

Yes. The solution is to make him repeat his original message as well, which couldn't have been intercepted because it was encrypted with our own key.

mandalar12• 12 years ago

No that is not a solution. If they swapped the public key they can read the message being sent back (it is encrypted with their public key), then encrypt it again with the real public key.

The only solution is to use another channel to authenticate the other's key, be it GPG's web of trust, or any other imperfect way (phone call, physically meeting, ...)

upofadown• 12 years ago

But no more insecure than the original interaction. It's a generic problem with anonymous public key crypto. Hence the stuff with the twitter fingerprint.

acqq4• 12 years ago

Twitter fingerprint was for Laura's key. Micah's public key was already published and already signed by other known people, so Snowden was sure than only Micah can read the e-mails for Micah, unless somebody hacked Micah's computer, when all bets are off and GPG doesn't help anyway.

davidholmesnyc2• 12 years ago

What a great article. To think this guy had no idea for months he was talking to one of the biggest whistleblowers of our generation. Reading this makes me wonder if there's room for a yellow pages style public key directory for journalists. That would of saved a lot of time and hassle.

rdl• 12 years ago

Equally awesome is that he DID know for months he had been talking to one of the biggest whistleblowers of our generation, and he maintained enough OPSEC (i.e. "STFU") that this didn't become widely known.

w8rbt• 12 years ago

I'm sure you've heard the phrase, "Discretion is the better part of valor". It is good to be brave, however it is also good to be discreet. If you are cautious and discreet (keep your mouth shut and don't brag), you will probably not be put into a situation that requires bravery.

dmd• 12 years ago

there's room for a yellow pages style public key directory for journalists

There is! Most journalists have a Twitter account or at least some verifiable online identity, so that's exactly what https://keybase.io/ is for.

davidholmesnyc2• 12 years ago

Awesome. Didn't know that existed. I have to check it out for my own personal email communications between my friends.

na85• 12 years ago

Doesn't keybase require you to upload your private keys to them? I can't think of a worse approach.

NiftyFifty• 12 years ago

Depends on your opinion, and honestly if he _was_ a legitimate whistle blower (as stated by current law, not my personal view), don't we think he'd be protected under the Whistleblower Act (http://www.law.cornell.edu/uscode/text/18/794) or any sort of legislation ->currently<- in place? Matters of National Security does not qualify and to be frank, and its pretty clear he is guilty of treason (no matter what my opinion is, again). This most likely isn't a popular view here on YC (I am not judging anyone openly here), but this makes for fascinating reading. Edward Snowden is no better than John Walker, Aldrich Ames, Aaron Burr (VP of the United States!!), and Benedict Arnold. Russia really didn't want him, but they sure didn't exactly push back considering whatever Snowden had on his person (or remotely access to) and surely has been taken and shared with the Chinese as well. I'm simply trying to provide the deep (on occasion conflicting) loyalties that underlie many security professionals in this country that are married to the ultimate goal of protecting interests domestic and abroad of the United States. They are the best and brightest, and the leadership generally above them are FROM the ranks of trusted/vetted/experienced individuals.

pyre• 12 years ago

Your post is interesting, so I'm not downvoting, but at the same time it comes across as a shill post.

Russia really didn't want him, but they sure didn't exactly push back considering whatever Snowden had on his person (or remotely access to) and surely has been taken and shared with the Chinese as well.

To be frank, if security (at the NSA) was/is as lax as Snowden claims, then none of the information is probably news to Russia or China. That said, I was under the impression that Russia and China aren't exactly bed-fellows, yet you claim that 'surely' the information has been shared. I don't think that's a foregone conclusion (assuming that there is any new information to share).

I'm simply trying to provide the deep (on occasion conflicting) loyalties that underlie many security professionals in this country that are married to the ultimate goal of protecting interests domestic and abroad of the United States.

The problem is that protecting US interests isn't some cut-and-dry thing. The CIA trained and funded Osama bin Laden to 'protect US interests' (in repelling the USSR from Afghanistan). How did that work out? The US went into Iraq because "WMDs" existed that Saddam Hussein was going to launch against our allies. How did that work out? The US intelligence community has been pushing for revolution in the Middle East... now we have a bunch of countries in turmoil, and ISIS running rampant. How did that work out?

I remember top US officials claiming that the Iraqis would "welcome us as liberators" as if everyone would just abandon Saddam and start cheering "USA! USA!" as soon as troops cross the border.

I question the qualifications of the people making these decisions.

They are the best and brightest, and the leadership generally above them are FROM the ranks of trusted/vetted/experienced individuals.

I'm not really sure what this has to do with anything. How does this relate to Snowden? How does this related to NSA whistleblowers? How does this relate to treason even?

jordanpg• 12 years ago

This article highlights for me how much the world could change if the overall knowledge level about PK crypto was raised -- if it became as intuitive for the non-technical user as, say, protecting physical keys.

th0br02• 12 years ago

The issue is that governments would then start to selectively prohibit crypto...

Zigurd• 12 years ago

Prohibiting strong crypto would create a huge contraband problem. That is, if you wanted to make strong crypto popular and attractive, you could hardly do better than to ban it.

dmix• 12 years ago

I could imagine the NSA has set up a team of people who collect journalists PGP private keys from their computers these days.

verytrivial• 12 years ago

The article says they went on to set up 'burner' keys, presumably generated on machines the journalists would not be expected to use. Prudent.

spacefight2• 12 years ago

And they tweeted the fingerprints quite often.

GHFigs• 12 years ago

Glad to see The Intercept is still bringing those hard-hitting revelatory leaks instead of merely capitalizing on public idolization with hagiographic exclusives.

lazaroclapp2• 12 years ago

"The frustrating and ironic thing about GPG is that even experts make mistakes with it. [...] in his first email to me, Snowden had forgotten to attach his key, which meant I could not encrypt my response. I had to send him an unencrypted email asking for his key first."

So, not only can't Johny encrypt (http://www.gaudior.net/alma/johnny.pdf), but neither can security experts when their lives may depend on it. Proving once more that not only do we need better security tools, but - above all - more usable security tools.

corv• 12 years ago

We're getting there: https://www.mailpile.is

meapix• 12 years ago

From UI perspective, this is already behind.

beambot• 12 years ago

I'm not a security expert.... but shouldn't exchange of the public key happen outside the channel of the message (ie. using a public key / certificate authority)? Otherwise, I could fake the message origination: write my own message, encrypt w/ my private key, and then sending you my public key -- you'd never know the message came from me rather than Snowden. (Could also do a more-sophisticated MITM.)

nmjohn• 12 years ago

Depends on the situation.

An anonymous person contacts you - how do you get their key from a public authority? There is no impersonation attack possible in this case.

Someone claiming to be Edward Snowden contacts you today (now that he is longer anonymous) - in this case yes, the author just including their key would not necessarily be secure.

lazaroclapp2• 12 years ago

I guess is an opportunistic encryption vs no-encryption scenario, since Snowden was sending his emails anonymously at that time there was no way for him to verify his identity to anyone. However, this was before there was any attention on him and sending his public key inside his first encrypted email would at least offer guarantees of the form: "If this connection is not MITM'ed now, it cannot become MITM'ed in the future". I suppose Snowden would know if there was indiscriminate and automatic mass-interception of GPG at the time (there might be now).

I am also not a crypto expert, but as I understand it: Micah could have also encrypted the email with the key given to him by the 'anonymous mailer', included the hash of that key as part of his message and then signed the whole message with his own key. Since Snowden trusted Micah's key, he could verify the email signature and then check that the included hash matched his own key. A MITM attacker could intercept Snowden's first email and change the key, but then Micah would have hashed the fake key and included that in his email, which the MITM couldn't alter without breaking the signature, then Snowden would have seen the wrong hash on the reply email and know of the presence of the attacker.

emergentcypher• 12 years ago

If you're being contacted by an anonymous person you have no idea who they are in the first place. Since you don't know an anonymous person's identity, how are you supposed to fetch and validate their public key?

Istof• 12 years ago

it should happen offline but many times that is not possible

acqq4• 12 years ago

The basic idea of public key is to be visible to everybody. I consider the real problem to be "spamming." If you have some site which stores the keys and it has a thousand of different public keys claiming to be from, e.g. "Laura Poitras" you don't know which one is the real one. So the selection of the "real" key between of all of possible keys is something that should be verified independently. Even if you have only one key, you must verify that really that key belongs to the person you want to reach.

Snowden solved it by requesting the public tweet of Lauras's key fingerprint which was enough. Having the match of the fingerprint is enough. It's much smaller than the whole key. For example, if Laura's key is 4096 bits to print it you'd need around 700 letters. But to verify some 4096 bits you have to actually be Laura's key, it's enough that the fingerprint of, for example, 160 bits match: the math magic involved in creating the fingerprint should guarantee you that nobody can create another key and have the same fingerprint.

In the article, the fingerprint used 4 bits per letter, and there were 40 letters, so it was just 160 bits that Snowden used to verify the key.

minusSeven• 12 years ago

Great read. This is stuff movies are made of, but in reality its seems more horrifying.

redwaldciei8379• 12 years ago

0.) Greenwald makes same pattern of mistakes at least 3 times. Get a tainted USB by federal express and get the USB firmware level compromise. Its a common LAZY practice, so ALL USB in Fedex are changed at the central shipping hub. The history is to dissolve glue on envelope and reseal. Today it is automated, perhaps. This is sci fi, of course.

2nd time Greenwald - use your partner to carry the solid state devices. Lead to the 'drug war sweep' at the airport. Yes, your clothes are removed to 'distract you' and to make sure that you are not 'hiding' any USB drives.

3.) There are few 'excellent journalists' left. That's why WE concentrated all of them on da verge as a single point of failure.

4.)Salient fact: there are only 2 techies that know gpg in the org and the journalists dont care to learn or dont know what is important?

5.)three factor authentication == security. 1 factorr eencyrpted key rates low.

6.)xkcd comic badone has hammer on your head and u will give password. a/pple bio-metrics fooled again by latex clone. no 3 is how u play. game: chess 'sing fortissimo' n-q6 (if I play a rank 1600 move, it means REVOKE credentials, a 1900 move means pass)

7.)thought experiment - the radio operator is parachuted into enemy territory. Captured and turned? or maybe...

8.)increas eing the noise to the signal for the metadata is more important.of the h-l or letter h munus 1 which looks like letter l - -pg for 3 letter acronym - is basic. so, twitter source is too low entropy. steagan image or TWO simple texxt on public website forum means plenty oof of downloaders.

summary 1.)who are the top 3 in the world? 2.)single point of faliure on one email website? 3.)meta-info ENCRYPTED MESSAGE HIDING plus tor, etc trust attack or even simple denial of service attack leaving only the 'bad ones' to be used.

8.)joke crypto. old Russian proverb. we pretend to work and they pretend to play us ... oops pay us..

yoops slay us? So mister red wald start up the joke contest and have plenty of playing the part of the green herring or is it purple herring - fuscia maybe? - i dunno. THIS WIL INNCREASE THE NOISE TO SIGNAL ratio where bad tyoists yuuppsie TYPISTS are then on the tracking list.

Using number theory and the many old people who love to play games and trade joiokes it is now time to look at spam and emails

adultSwim• 12 years ago

0 isn't crazy. Why not interdict all packages going to key government critics?

Crazy to think that NSA wouldn't be monitoring journalists to catch their sources.

Smuggling Snowden Secrets

Related Stories