Public Address | Cafe | OnPoint: BTW, the NZ Police can use PRISM against you now

"chris"

Wed, 11 Sep 2013 16:17:08 +1200

It’s a frightening time.

I’ve considered this statement a while, and I’m not sure if it’s any more or even as frightening for the activist community as the aftermath of October 15th 2007. Perhaps recklessly, perhaps numbed, having lived a decade in a nation (PRC) where the Government has little…

BenWilson

Fri, 06 Sep 2013 16:16:46 +1200

Well anyone small enough to be intimidated by NSA agents anyway. No sovereign government is required to do as the NSA says with respect to it's security protocols, indeed they need not even say what they are. I have no idea what the Russians use, and would seriously doubt anyone…

Rich of Observationz

Fri, 06 Sep 2013 16:06:43 +1200

I would imagine that anyone with truly nefarious intent would have taken the hint and be communicating by couriered pieces of paper, etc.

BenWilson

Fri, 06 Sep 2013 15:51:28 +1200

Reading the signals of foreign governments is, by far, the biggest interest of the intelligence services, with those of nefarious intent a close second.

Except that governments actually use strong encryption for anything secret enough to bother. They can, after all, organize a key exchange that can't be intercepted.

criminals/terrorists…

Matthew Poole

Fri, 06 Sep 2013 15:45:44 +1200

the stupid problem of trying to hack the security of private individuals

And foreign governments, and criminals/terrorists. It's not about reading your and my email, though that's a handy bonus prize. Reading the signals of foreign governments is, by far, the biggest interest of the intelligence services, with those of…

Matthew Poole

Fri, 06 Sep 2013 15:43:15 +1200

I’m assuming the GCSB is one of GCHQ’s 2nd Party partners:

From the BULLRUN Briefing Sheet From GCHQ

At TOP SECRET STRAP1 COMINT AUSCANZUKUS EYES

AUSCANZUKUS (pronounced Oz-Can-Zoo-Kus by those in the defence/intel communities) is shorthand for the Five Eyes partners so, yes, GCSB is one of those on the…

BenWilson

Fri, 06 Sep 2013 15:37:20 +1200

Interesting as to whether it’s a component or system-wide crack. Factoring public keys would give them full access to anything under than private key

My understanding is that the proof that cracking the keys necessitates using an algorithm whose complexity is exponential, comes down to showing that if you can…

Martin Lindberg

Fri, 06 Sep 2013 14:06:48 +1200

Well, at least NZ gets to benefit(?). I'm assuming the GCSB is one of GCHQ's 2nd Party partners:

From the BULLRUN Briefing Sheet From GCHQ

At TOP SECRET STRAP1 COMINT AUSCANZUKUS EYES

The fact that GCHQ or its 2nd Party partners has some capability against the encryption used in a…

Matthew Poole

Fri, 06 Sep 2013 13:40:23 +1200

Maybe they take the view that even if the Russians know the location of every Trident sub, they probably won’t be starting a nuclear war anytime soon.

There's much more than just unit movement orders at stake, and many more outfits than just the Russian intelligence services who would be…

Martin Lindberg

Fri, 06 Sep 2013 13:28:04 +1200

Scarier is “N.S.A. Foils Much Internet Encryption” – it’s hard to tell exactly what they’re saying there, but it seems to hint to me that SSL is toast.

There's a good summary of the latest news (including the NYT story you referenced) at Ars Technica:

[[http://arstechnica.com/security/2013/09/nsa-attains-the-holy-grail-of-spying-decodes-vast-swaths-of-internet-traffic/|NSA attains the Holy Grail…

Rich of Observationz

Fri, 06 Sep 2013 12:52:41 +1200

Interesting as to whether it's a component or system-wide crack. Factoring public keys would give them full access to anything under than private key, while cracking the conventional crypto would have to be run for every session and any sort of active attack on the protocol (like MITM) would be…

Matthew Poole

Fri, 06 Sep 2013 12:44:14 +1200

It is telling that the NSA approves particular combinations of public security protocols for securing information up to and including material classified as Top Secret. Historically they have only approved black-box crypto systems for such material. If they are prepared to allow US national security material to use these protocols,…

Matthew Poole

Fri, 06 Sep 2013 11:54:37 +1200

it’s hard to tell exactly what they’re saying there, but it seems to hint to me that SSL is toast.

__ Cryptographers have long suspected that the agency planted vulnerabilities in a standard adopted in 2006 by the National Institute of Standards and Technology, the United States’ encryption standards body,…

Paul Campbell

Fri, 06 Sep 2013 11:45:55 +1200

Bruce Schneier is a little pissy ....

"To the engineers, I say this: we built the internet, and some of us have helped to subvert it. Now, those of us who love liberty have to fix it."

word

Paul Campbell

Fri, 06 Sep 2013 11:37:43 +1200

What we really need are some great mathematicians who aren't beholding to anyone

Matthew Poole

Fri, 06 Sep 2013 11:29:05 +1200

it seems to hint to me that SSL is toast.

SSL has been toast for a long time. TLS wasn’t created just for the sake of it, and TLS1.0 is already considered insecure.

Paul Campbell

Fri, 06 Sep 2013 11:28:15 +1200

one has to assume that some percentage of everyday spam is the NSA trying to grow their stable of pwned machines

Rich of Observationz

Fri, 06 Sep 2013 11:01:20 +1200

I'm seriously hoping that someone in NSA/GCHQ/GCSB gets caught in massive financial fraud soon:
– grabbing credit card transactions
– grabbing online banking logins
– some other type of couffabling

I imagine this must be happening on some scale and being covered up, but it might wake up the sheeple…

Paul Campbell

Fri, 06 Sep 2013 10:42:38 +1200

Scarier is "N.S.A. Foils Much Internet Encryption" – it's hard to tell exactly what they're saying there, but it seems to hint to me that SSL is toast.

Ian Dalziel

Fri, 06 Sep 2013 09:44:50 +1200

the machines did it!
Keith, looks like another Gov't dept is experiencing computer problems...
An immigration bungle in which a computer gifted an extra 120 people a place on a visa scheme has raised doubts about the Government's $80 million online visa programme.
Documents provided under the Official Information Act…

Ian Dalziel

Fri, 06 Sep 2013 09:30:18 +1200

A Stick Figure Guide to the Advanced Encryption Standard (AES)

I was just about to re-aggregate that from boing boing myself!
:- )

Martin Lindberg

Fri, 06 Sep 2013 08:44:18 +1200

While it's already possible to securely encrypt email using public key encryption, as Keith is demonstrating, it's still a pain. The good thing about the revelations around NSA et al is that this has created a much greater public interest in security. So now there is a need for an…

Steve Barnes

Wed, 04 Sep 2013 10:50:02 +1200

. it’s going to be a very sparse matrix

That's Stoatally amazing, was it weasely implimented?.
(he asked, on his Lenovo)

Paul Campbell

Wed, 04 Sep 2013 08:15:12 +1200

well there's that whole low power only good for a km or so thing and the fact that this will be an all solar net only running for a few minutes a day on the smell of an oily rag in a bush filled valley .... it's going to be…

Ian Dalziel

Wed, 04 Sep 2013 07:35:57 +1200

needs mustelidae...
...even though we’re just building a
mesh net to monitor stoat traps
What a cunning plan, to hide in plain sight as you beaver away on your plans for a breakaway Southern Tartan 'Stoat-tally-tarian Matrix '...

;- )

Paul Campbell

Wed, 04 Sep 2013 07:11:49 +1200

And on my desk is a pile of NZ designed, NZ built, boards also with TI hardware – I have to sign that same agreement to get the chips (AES, and I use it, even though we're just building a mesh net to monitor stoat traps) – the rules are…

Rich of Observationz

Tue, 03 Sep 2013 16:26:43 +1200

I have a Raspberry PI and a Beagleboard on my desk: both are British system integration, British CPU architecture, open-source everything from the bootrom up, US chipset and physically stuck together in China. (NZ designed and built case, too)

Also, simple enough that the community would probably find any trapdoors…

Chris Waugh

Tue, 03 Sep 2013 16:04:51 +1200

And another bit of cosmetology I noticed with that Independent article:

the state-backed technology company

and:

It is the latest company with links to the Chinese state to fall foul of concerns about its hardware

Suitably scared yet? Because here's the state backing:

Lenovo, which is based in Beijing, is…

Matthew Poole

Tue, 03 Sep 2013 15:51:08 +1200

And relatedly, kinda, Snowden's latest document leak is part of the US-FY13 "Black Budget" document that goes to the Congressional Budget Office. Highly-classified doesn't quite adequately describe something which is only meant to be seen by US citizens who hold Top Secret clearance with Sensitive Compartmented Information access to the…

Steve Barnes

Tue, 03 Sep 2013 13:23:21 +1200

MI6 and MI5 ‘refuse to use Lenovo computers’ over claims Chinese company makes them vulnerable to hacking

Like Duh! Oceania has always been at war with East Asia, get with the program kiddo.
And... American computers are so doubleplus good that those inferior Asian units don't stand a chance of…

Matthew Poole

Tue, 03 Sep 2013 11:46:00 +1200

MI6 and MI5 ‘refuse to use Lenovo computers’ over claims Chinese company makes them vulnerable to hacking

__The discovery has led to a written banning order being issued among the “Five Eyes” alliance of British, American, Australian, Canadian and New Zealand eavesdropping agencies, including the US National Security Agency, according…

Paul Campbell

Tue, 03 Sep 2013 09:35:06 +1200

well of course they are, they keep putting Windows on them

Martin Lindberg

Tue, 03 Sep 2013 09:27:12 +1200

Now how do I choose an ISP who publishes their router source?

That may not matter if you have a Lenovo PC anyway.

MI6 and MI5 'refuse to use Lenovo computers' over claims Chinese company makes them vulnerable to hacking

Sacha

Mon, 02 Sep 2013 23:52:23 +1200

unwilling students of history, all

nzlemming

Mon, 02 Sep 2013 22:08:23 +1200

I may have paid off the mortgage on my 1/4 acre and 1970s assortment of sticks and jib, too, which will be worth approximately 50 million dollars.

Don't worry, you'll still have your student loan to keep you warm. Even if you never took one out...

BenWilson

Mon, 02 Sep 2013 20:19:24 +1200

Who knows, we may be folding information like proteins or tensegrity structures soon… or some kinda dark data dump device…
:- )

Well it'll be half the Cheops pyramid next year, a quarter the following, and in about 40 years I'll have a whole bunch of camera sticks that size…

Steve Barnes

Mon, 02 Sep 2013 16:25:09 +1200

Unless we can get a lot more clarity on the relationship between the GCSB and the NSA/GCHQ and on the legal restrictions on data obtained from them, John Key’s assertions are basically meaningless. What’s interesting is that, like tax law, purely national laws are becoming increasingly irrelevant as technology advances,…

Paul Campbell

Mon, 02 Sep 2013 12:59:50 +1200

And let's not forget the Israeli contributions to the field...

err, well yeah – Israeli designed crypto is sitting in your Sky TV box and possibly your household wireless phones too – NDS (now owned by newscorp) has a particularly shady past

nzlemming

Mon, 02 Sep 2013 12:14:33 +1200

and maybe it could retain a Welsh connection
by renaming it, er, Jonestown…

As long as there's no Kool-aid...

Ian Dalziel

Mon, 02 Sep 2013 08:23:05 +1200

yeah so we have two choices, hardware
with NSA spook backdoors and hardware
with Chinese spook backdoors
And let's not forget the Israeli contributions to the field...

Ian Dalziel

Mon, 02 Sep 2013 08:10:33 +1200

Save the Wales...
Maybe Napier, with it’s art deco buildings,
can double for Portmeirion?
and maybe it could retain a Welsh connection
by renaming it, er, Jonestown...

Greville Whittle

Mon, 02 Sep 2013 07:59:24 +1200

Maybe Napier, with it's art deco buildings, can double for Portmeirion?
Be seeing you...

Ian Dalziel

Mon, 02 Sep 2013 07:52:22 +1200

anything could happen...
...a yottabyte of data takes as much volume as the Pyramid of Cheops. It’s staggeringly large and strikes me as unlikely too.
Who knows, we may be folding information like proteins or tensegrity structures soon... or some kinda dark data dump device...
:- )

Kumara Republic

Mon, 02 Sep 2013 01:48:55 +1200

If Singapore is "Disneyland with the Death Penalty" according to William Gibson, then NZ risks turning into Rainbow's End with Roving Spheres.

Paul Campbell

Sun, 01 Sep 2013 20:38:20 +1200

yeah so we have two choices, hardware with NSA spook backdoors and hardware with Chinese spook backdoors Rich is right we need open source hardware all the way.

Now how do I choose an ISP who publishes their router source? an international fibre provider who does the same?

Martin Lindberg

Sun, 01 Sep 2013 17:12:45 +1200

Maybe the big fuss about Huawei equipment is not that they are Chinese made, but that they are too good and can’t be broken in to, and can’t be persuaded to add secret back doors, I can see why that might piss off our secret powers that be

Possibly, but…

Rich of Observationz

Sun, 01 Sep 2013 17:10:30 +1200

Basically, we need to move to open source based router and infrastructure platforms that can be independently analysed for malware and trapdoors.

Paul Campbell

Sun, 01 Sep 2013 16:03:21 +1200

The Washington Post reports that the NSA "breaks into foreign networks so that they can be put under surreptitious U.S. control." and that they "has placed 'covert implants, sophisticated malware transmitted from far away, in computers, routers and firewalls on tens of thousands of machines every year, with plans to…

Ian Dalziel

Sun, 01 Sep 2013 14:27:55 +1200

Tor usage doubles!!
This week on the Tor e-mail list, Roger Dingledine, the project leader for the well-known online anonymity tool, pointed out that the “number of Tor clients running appears to have doubled since August 19.”
Wasn't Keith's first post on this, roundabout August 19ish.
Now we have an…

BenWilson

Sat, 31 Aug 2013 23:25:05 +1200

Indeed, even if they're only keeping a few gigabytes of data on me, that's a few gigabytes too many.

Colin Fleming

Sat, 31 Aug 2013 18:05:20 +1200

Just to be clear, a yottabyte was only bandied around at the very beginning of the reporting on all this, Binney's estimate was 5 zettabytes (2-3 orders of magnitude less). 5 zettabytes still doesn't seem to be practical at the moment but may be within, say, a decade or two.…

Jarno van der Linden

Sat, 31 Aug 2013 17:08:08 +1200

Another constraint is the annual worldwide harddrive production. It’s roughly 500 million units. Give them each 1TB, that’s only half a zettabyte total.

BenWilson

Sat, 31 Aug 2013 10:36:05 +1200

However, all that said, even in the most compact storage form we can currently get, a yottabyte of data takes as much volume as the Pyramid of Cheops. It's staggeringly large and strikes me as unlikely too.

BenWilson

Sat, 31 Aug 2013 10:33:39 +1200

To clarify what I'm saying there, estimates of how much energy is needed would require us to know how frequently the data is accessed, and how fast the access would need to be. So it really depends how it is used, and the NSA may be using it completely differently…

BenWilson

Sat, 31 Aug 2013 10:13:31 +1200

The NSA is still bound by basic laws of physics around heat production and cooling capability, no matter what they do, so reasonable deductions can be made by looking at how much cooling capacity they’re providing.

Do we know this figure? Also, I'm not sure you can deduce storage capacity…

Matthew Poole

Sat, 31 Aug 2013 10:03:21 +1200

Chokers!
No sense of ambition, obviously!

Oh, I have no doubt they're that ambitious, there are just minor physical laws which come into play.

Ian Dalziel

Sat, 31 Aug 2013 08:54:46 +1200

Pulsing, pulsing, electwrongs...
There’s no way the Utah DC is being constructed to process something like six orders of magnitude more electronic data than is currently produced by the online world.
Chokers!
No sense of ambition, obviously!
;- )

Matthew Poole

Sat, 31 Aug 2013 08:41:06 +1200

I think that it’s likely that the NSA has a much higher data density than private organisations – Google, for example, has much more efficient data centres than most private organisations because they design everything themselves, and it’s reasonable to assume that the NSA does the same, but you’re right,…

Colin Fleming

Fri, 30 Aug 2013 14:38:37 +1200

Interesting, I hadn't seen that, thanks. I think that it's likely that the NSA has a much higher data density than private organisations – Google, for example, has much more efficient data centres than most private organisations because they design everything themselves, and it's reasonable to assume that the NSA…

Matthew Poole

Fri, 30 Aug 2013 12:28:27 +1200

[NSA’s] new data centre in Utah is estimated by William Binney (ex-NSA operative turned whistleblower) to store 5 zettabytes

A figure which is now believed to be over-blown by many orders of magnitude. People who actually know servers and infrastructure are saying the figure is exabytes, definitely, but certainly not…

Colin Fleming

Thu, 29 Aug 2013 23:41:54 +1200

I actually posted about this over on Pundit with respect to John Key's assertions that the GCSB bill won't allow wholesale spying – I'll paste it below because I think it's relevant (and I can't seem to link to a comment on Pundit):

I'm a little late to this discussion,…

Chris Waugh

Thu, 29 Aug 2013 15:51:47 +1200

Was he looking simply for a picture or content within the picture? Because "chris"'s two examples above are a technique for posting sensitive content to Weibo, the idea being that the keyword filters that alert the censors can't read text in an image file because it's a picture, or at…

Keith Ng

Thu, 29 Aug 2013 15:17:10 +1200

Thanks, it took me nigh on 1/2 an hour though so...

*LIKE*.

BenWilson

Thu, 29 Aug 2013 13:54:59 +1200

Even that wouldn’t work.

Yup, hiding data is pretty easy. The security guy at a firm I was in once challenged me to get a picture file past his extensive filters. It took me about 10 minutes to code it up. It was in a spreadsheet file. He was shocked…

Ian Dalziel

Thu, 29 Aug 2013 11:42:04 +1200

oversight, outtasight...
Australian intelligence sources have also told Fairfax Media that Singaporean intelligence co-operates with Australia in accessing and sharing communications carried by the SEA-ME-WE-3 cable which lands at Tuas on the western side of Singapore Island.

Access to this major international telecommunications channel via Singapore's government-owned operator SingTel…

"chris"

Thu, 29 Aug 2013 02:14:59 +1200

Yeah, you got me, totally Chinese net practices. In the unlikely event I were to ever go renegade I'd be quite partial to the idea of using more pinyin for this kind of thing.

"chris"

Thu, 29 Aug 2013 02:05:43 +1200

Thanks, it took me nigh on 1/2 an hour though so...

Chris Waugh

Wed, 28 Aug 2013 21:52:27 +1200

That strikes me as two textbook examples of Chinese internet censorship evasion – also evading Weibo character limits, but more importantly getting stuff out there in formats the censor spiders won't immediately pick up on rather than regular text. Well done. Especially the second.

kiwicmc

Wed, 28 Aug 2013 21:44:45 +1200

much better

"chris"

Wed, 28 Aug 2013 20:52:42 +1200

font, surely…

Yeah it's (s)nans.

"chris"

Wed, 28 Aug 2013 20:31:38 +1200

Tim Michie

Wed, 28 Aug 2013 20:21:49 +1200

lovely clear piece of hand writing font, surely...

Sacha

Wed, 28 Aug 2013 19:52:22 +1200

lovely clear piece of hand writing

reckon

kiwicmc

Wed, 28 Aug 2013 19:47:41 +1200

now there's a lovely clear piece of hand writing to OCR. I reckon I could have got about 80% of that using a piece of neural network kit that's 15+ years old

B Jones

Wed, 28 Aug 2013 19:45:28 +1200

(short of filling the HD with cat pictures)

Even that wouldn't work.

"chris"

Wed, 28 Aug 2013 18:41:09 +1200

Stephen R

Wed, 28 Aug 2013 17:06:44 +1200

There's a hack for that.

Only if you don't tell anyone you're using it. The problem is that truecrypt makes it very difficult to prove you haven't got a hidden encrypted disk (short of filling the HD with cat pictures) in which case, being innocent won't stop the rubber hoses.…

Martin Lindberg

Wed, 28 Aug 2013 17:05:22 +1200

There’s a hack for that.

not really

http://xkcd.com/538/

Idiot Savant

Wed, 28 Aug 2013 16:58:30 +1200

I moved to Acceptance some time in the 1990s when I realized that the rubber hose method will always work if they want your data.

There's a hack for that.

BenWilson

Wed, 28 Aug 2013 16:37:43 +1200

I was already on ”Depression”, and forgot that everyone else was still on ”Anger”.

I moved to Acceptance some time in the 1990s when I realized that the rubber hose method will always work if they want your data.

Juha Saarinen

Wed, 28 Aug 2013 16:09:39 +1200

The size and scale of the "e-surveillance" is enormous and started some thirty years' ago, maybe longer. Paul Brislen wrote about it in the late 90s, Nicky Hager has covered it lots, and more and more pieces of the puzzle are falling into place – like your blog post Keith.…

Stephen R

Wed, 28 Aug 2013 14:47:07 +1200

If you wanted to post something publicly that you thought someone else might edit, signing it but not encrypting it would provide anyone who looked at it (and cared enough to check) with confidence that it was what you actually wrote.

Assuming that nobody else has your private key, it's…

Matthew Poole

Wed, 28 Aug 2013 14:25:18 +1200

So, is it worth both encrypting and signing? If so, what’s the preferred order?

Depends what you’re after. Signing validates the integrity of the message and verifies the sender. Encryption is, well, encryption.

Encrypting then signing puts the signature in the clear, allowing it to be viewed by anyone (or…

Idiot Savant

Wed, 28 Aug 2013 14:16:07 +1200

So, is it worth both encrypting and signing? If so, what's the preferred order?

I'm planning on doing my own key-signing party this weekend. I've got some cards with my key ID and fingerprint on them to hand out; people I meet can then import my public key from the…

Thomas Beagle

Wed, 28 Aug 2013 14:05:31 +1200

I'm still kind of annoyed that @techliberty got its highest number of retweets (55+) for linking to your article rather than from any of our own work. :)

Public Address

Wed, 28 Aug 2013 14:05:31 +1200

Discussion from blog post.