Hacker News Reader

Comment by yan | Hacker News Reader

This whole situation definitely feels like the start of something much larger than just Google pulling out of China.

"This whole situation definitely feels like the start of something much larger than just Google pulling out of China."

The assumption in government (and of security researchers) right now is that every time you send an email, it gets read by 25 or so countries. However, they haven't bothered to tell the general public this yet. My guess is that they are going to use this incident to either start to break this news to the general public, or else push through additional computer security measures. Possibly both.

    -----BEGIN PGP MESSAGE-----
    Version: GnuPG v1.4.7 (Darwin)
    Comment: Remember Lexington Green!

    hQENA+4fGjU8+s3CEAP45kAPM5FMQJpNHb+0ve98gqLhXwwmQ0e6VUIx3WAb1D6/
    lhFcIg0/7lNLahoijQAA4zqv6V614LRMnkFHSZgE8he5pCqks4b139tYw6CvndS3
    Rl0AuNpWSSrG1tiayrYcvsH1Il79E3tnQJkSCaU90FXu/h0XdYF73lbC8+Ct5QP9
    H2AI2yEVfa3/FcDqPU2FsOL23mCmIn4J3BJK/6vaFqDEUttaY5xkucm2uUQLsj6t
    73llq0yFhpQ3YBUfIO6/RuS9wZMJaw0oisF65dtPF2zf4IFQFZTjvBZBdk3za4Wc
    s69JkSXLVx0sX6VrAnsk1pnHcvK+IvDt4CHvv/arlSbSngGpCYdbXkQTBzsqyulh
    JEVgB5VrWuK6L+/k6evXmIkus5wF3w4QoC8Zo7UslEZhh3bfaxXqT2B4wmOklZOA
    HwaFeo7m/ERqgl2ZsjN+AL48HC6GQP5YwMxwhJ4qTH74K0kgbgWkAMBnSVw2Up0y
    rSJrLysQDhN7WXSLAtiS0ZgjZ6LQUuZ6doUvg+g9a2AQJtLj/vTGhBORC0/Id3Cj
    =dvov
    -----END PGP MESSAGE-----

A temporary stopgap, at best, especially in a world where so few people use it. Encryption is maximally useful when people don't see -- or it doesn't matter that people see -- that you're using it.

My guess is that people who really, really want to protect what they saying and that they're saying it use nonsense spam as a steganographic medium.

Maybe they already are--what other purpose would there be for nonsense spam?

Nonsense spam messes with adaptive spam filters. They learn bad rules, thus it becomes harder to identify real spam.

----

Edit: I don't know how effective it really is, but this seems to be the motivation for why spammers at least try this. Many more details here:

http://en.wikipedia.org/wiki/Bayesian_poisoning

Wouldn't you need significantly more noise spam than signal spam for that to work? Is that what we indeed observe?

But since that's a public good (for spammers) it's hard to understand why they'd do it instead of sending a profit-making campaign, any given time.

If I ran an oppressive, evil regime, one of the first things I'd arrange would be traffic analysis of encrypted or otherwise suspicious email.

If everyone was sending encrypted emails it would be unpratical, though.

You can still analyze that Bob emailed Cindy and that Cindy emailed Marge, even without knowing the content of the emails. IIRC, the FBI has some sort of software that does this with telephone communications to identify 'networks' that was originally developed to combat the mafia.

Yes, and you can break Bob and Cindy's fingers to get their passphrases. That is a very easy step. That is why steganography should be used. There shouldn't even be an ecrypted text for them to try to decrypt, at least as far as they know. Because once, there is, they can always get the password. The next best thing is is fake encryption or some kind of nested encryption, so that the outer layer decrypts to something plausable but ultimately benign.

A password doesn't even fall under 'free speech', so even in a free country like US one can get slapped with 'obstruction of justice' if one doesn't provide a password. I'll leave it to your imagination to what happens in other, more oppressive countries...

That may be true for most emails.

But I guess that large webmail providers can band together and ensure that e-mails between their systems are encrypted (i.e. all messages sent by gmail to other gmail addresses or hotmail addresses are encrypted).

Then users would just use HTTPS to check their mail and everything would be encrypted.

This is not perfect, but it is at least a stopgap.

This is why you're not running an evil regime.

Is your implication that smart, clueful people are never evil? Of course, you can always find an apologist who will explain that any given regime wasn't or isn't evil, so how would you test that?

No, not at all. My implication is that analyzing encrypted email traffic is probably the last place you should be looking. Trying to break encryption is almost always the hardest way to acquire information. Physically intimidating people, targeted client-side attacks, or a number of other things that you can do will be much more effective and easier than breaking crypto.

On the flip side of your statement, I think evil, oppressive regimes hire very smart and talented people.

The goal isn't to break the encryption, it is to find out who has something to hide.

Hey, IT Goons. Spy on the network traffic to find out who is using encrypted communication, and who they are communicating with. Then pass that information to the knee-breakers, so we can find out what they are hiding.

This has nothing to do with breaking crypto. The breaking is done in an oubliette.

The $5 wrench comes to mind: http://xkcd.com/538/

Or, the goons will just install a keylogger on your computer while you're away from the house. Or they'll try to exploit one of the umpteen jillion vulnerabilities in OSes and browsers to install something similar on your system remotely.

Or, they'll use a TEMPEST attack to read your screen without you even knowing it. Or they'll use a similar attack to read your keystrokes wirelessly.

Or, they'll get you in a room and use a $5 wrench on your face until you tell them what they want to know.

Breaking encryption is far down the list of techniques that are worthwile to oppressive regimes.

But the OP didn't suggest breaking the encryption, but to run a traffic analysis, which includes things such as identifying the realworld identities of people sending encrypted email, determing who those people are communicating with (both for their encrypted and unencrypted emails), and other ways of extracting information from messages without needing to actually break the encryption.

Once you've carried out this analysis, you know on who you can apply the more realworld techniques that you suggest.

Considering most of the email I send is from gmail to gmail, if it's getting read by 25 or so countries, Google has much bigger problems than they've been letting on.

I'd call it the opening salvo in a trade war, if not a new cold war. Expect to see a lot of political pressure for other companies to 'follow Google' and repatriate manufacturing operations and the like.

Our economy cannot function without cheap imports.

Fix Mexico (legalize it)

I've never understood why America outsources so much half way around the planet for cheap labor when it is available on her doorstep - a short flight, easy transport, same time zone , reasonably stable, friendly democracy ... what's not to like?

I can't find hard numbers on China's violent crime rate, but Mexico is around #6 per-capita in the WORLD. Might have something to do with it...

Sending manufacturing to China and other SE Asian countries is far cheaper than even Mexican labor. While 1 day's wages of a median Mexican assembly worker is less than 1 hour of a median domestic US assembly worker's wages; 1 day's wages of a median Chinese assembly worker is cheaper than 1 hour of the media Mexican worker.

There were some articles last year (or maybe it was 2008) about textile manufacturing in the US, and how the Chinese were subsidizing them to the point where even if the US workers worked for free, the US plants could not compete on price.

To understand how much manufacturing changed, I recommend reading The Box. The shipping container totally changed everything by reducing shipping costs by about 98%. A lot of cities that used to be manufacturing centers (such as NYC and Detroit) withered, and a lot of cities that used to be shipping centers (such as NYC and London) also shriveled up because they could not support container traffic.

http://www.amazon.com/Box-Shipping-Container-Smaller-Economy...

False, people will just have to buy less stuff.

So what would all of the people involved in the design, sale and distribution of that stuff do? Then what happens when the recently unemployed are put on welfare and stop paying income taxes? And what happens when raising taxes to compensate for the diminished tax base makes more thing unaffordable, further reducing spending... not to mention the questions about what happens when debts issued on the premise of growth go bad.

It is a cascading failure.

Yeah, might be a good time to get out of US dollars. They're going to be painful to hold, if China decides to make the US uncomfortable.

I voted this up, even though I think it's wrong, because it is a valid point. I don't think it's going to happen though, because it would screw up their own economy as badly as the US. Maybe if things weren't already so tight everywhere right now, but probably not even then.

...for now. There will come a time when dumping their dollars will no longer disadvantage China, and will indeed be to their advantage; but they need a somewhat larger middle class first. Give it ten or twenty years.

Interesting point. It is a sort of a MEAD (Mutually Economic Assured destruction), a complement to the nuclear MAD.

You would want to be extremely careful - despite all logic against it, the US Dollar spikes when just about any international crisis takes hold. The dollar's decline might well occur afterwards, but that would be a longer term consequence.

If China kills the dollar by dumping their reserves, they're going to hurt themselves just as much if not more than the US. They wouldn't do that over just Google. That's small potatoes compared to that...

Agreed, the amount of tight lipped cautiousness with which all parties are proceeding is mighty fishy.

I don't think I'd call Google's announcement either 'tight-lipped' or 'cautious'. It was unprecedented.

Reply on news.ycombinator.com