Hacker News Reader

Hacker News

Comment by mbreedlove | Hacker News Reader

Parent Full thread

mbreedlove

The insurance files are public. They just have to release the keys.

3.6GB - http://wlstorage.net/torrent/wlinsurance-20130815-A.aes256.t...

49GB - http://wlstorage.net/torrent/wlinsurance-20130815-B.aes256.t...

349GB - http://wlstorage.net/torrent/wlinsurance-20130815-C.aes256.t...

94GB - https://file.wikileaks.org/torrent/2016-06-03_insurance.aes2...

I don't know why they would put out a few hundred gigabytes of fake files. The contents might not be as interesting as people hope, though.

View on HN

>I don't know why they would put out a few hundred gigabytes of fake files.

Looks like you can check it now. The keys went public:

pre-commitment 3: UK FCO f33a6de5c627e3270ed3e02f62cd0c857467a780cf6123d2172d80d02a072f74

pre-commitment 2: Ecuador eae5c9b064ed649ba468f0800abf8b56ae5cfe355b93b1ce90a1b92a48a9ab72

pre-commitment 1: John Kerry 4bb96075acadc3d80b5ac872874c3037a386f4f595fe99e687439aabd0219809

https://twitter.com/wikileaks

Those tweets came out 7 hours before the Internet link message.

I speculate that these are only SHA256 hashes of keys or documents that will be released in the future. It's pre-commitment. I didn't try decrypting one of the files with a key yet, though. I'm busy with other things (like browsing HN, aaah).

The tweets are just hashes of the insurance files to confirm their validity, not the decryption keys (yet).

"Bluffing." It takes zero effort to distribute a a few hundred gigabytes of encrypted random data, relative to the amount of investigation and speculation as to what if anything is in those files. They are called "insurance." Assange/Wikileaks wanted to deter actions being taken against him.

Seems to me as likely as not that there is nothing really there.

the good news is that you don't even need to encrypt your data, if they are random to start with.

That might be tricky. An encrypted file may have some properties a random file does not have in general.

No, unless the algorithm is broken.

Ciphertext indistiguishability[1] is a basic requirement for any encryption scheme. All modern ciphers are designed to make that hard.

[1] https://en.wikipedia.org/wiki/Distinguishing_attack

Yes, but you remove that attack vector simply by encrypting a random file instead.

> I don't know why they would put out a few hundred gigabytes of fake files.

The same reason a stick-up man might put their hand in their pocket to mimic the shape of a gun. If you have no weapon, it's still often useful to make people think you have one.

> I don't know why they would put out a few hundred gigabytes of fake files.

To trick people like you? `dd if=/dev/urandom` is much easier than finding a comparable quantity of actual info.

I don't know enough to have much opinion on the odds that's the case, vs them being real, though.

There was a link on HN not too long ago to a quote from Assange, stating that part of the strategy is to sow uncertainty and doubt among the players to increase the secrecy tax. A multigig encrypted dump could have that effect.

That said he can't really play that card too often.

Reply on news.ycombinator.com