Verifying Wikileaks DKIM-Signatures | Hacker News Reader

Verifying Wikileaks DKIM-Signatures

solsticlipse.com

76 pointsteknotus37 comments

I didn't realize the signatures were leaked as well. Surprised nobody has looked at this yet, if we have cryptographic proof that certain emails are genuine, that shoots down a big counter-argument of "what if some emails are planted".

> if we have cryptographic proof that certain emails are genuine, that shoots down a big counter-argument of "what if some emails are planted".

Huh, no? I don't see how that follows logically.

If we have cryptographic proof that all email are genuine, then yes.

Right now we already know that some (most?) email are genuine. The question is whether or not the attacker, who was obviously motivated by political purposes, also inserted some fakes in the lot. (Although to me that seems highly unlikely)

Good point, but we know specifically which emails are genuine, and which may or may not be. Any particular email that isn't signed is questionable, but we can say for any given email whether or not it might be a fake.

If you click the "View Source" section, they have the entire MIME message. The display you see is formatted to make things easier to browse and list out any attachments (if any).

There has been no evidence yet that the emails were doctored. What there has been, as one journalist put it, was efforts to conflate "wikileaks emails" with "unsourced shit I saw on Twitter".

No evidence that they were doctored, but there are still plenty of complete fakes that were tweeted out by others, which were taken serious by way too many people including FOX news.

http://www.snopes.com/hillary-calls-voters-bucket-of-losers/

Very cool research!

Is there any proof-of-existence archive of DKIM keys or DNS record changes in general? Seems like a perfect use case for blockchain[1]. If the DKIM keys were rolled over or replaced since they were originally sent out, there wouldn't be anything to compare them against. Having a record that can show proof-of-existence (at a min point in time) would cover that.

[1]: Ha! I knew there would eventually be a legit use case!

This just requires the inability-to-rewind property of the blockchain, doesn't require there to be one centralized log of events and doesn't require protections against flooding with data (if we verify that the DNS records are correct at the point of inserting). This makes a certificate-transparency-like solution just as good and much less complicated (one can arguably call that blockchain, but usually people mean by that things that can support a currency).

Well, we've been making validated structures where a checksum (essentially a pre-cryptographic hash) of the last data-block is included in the next since the sixties. (And I suspect much further back in an accounting context.)

The difference these days is a protection, via proof-of-work, against just creating a new, valid, chain by editing the old one.

That proof of work, to be translatable into a dollar value, requires a market for the proofs and that's the currency part. (Without that you don't know the true market value of the energy required for the PoW.)

I think the major problem of this election is deciding on what the truth is but since everything can be rewritten, links broken, and data lost there is too much noise to get a clear signal. We need a trust/identity protocol that allows us to take history in account I wrote a draft of a whitepaper on a possible way to implement this with blockchains and cross-signing https://hashd.in/hashd-in-draft0/

I remember having issues verifying emails with attachments last time I've used dkimverify.

Any insight into what breaks verification is useful. Thanks!

Some quick numbers for those interested:

Excel sheet has 11104 rows 2423 verified - 22% 8681 not verified - 78%

Yes, the interesting thing would be if any emails with controversial content can be verified. I don't think there were any real bombshells in the wikileaks emails, but still...

Most of the things i've came across that are being brought up as bombshells are actually incoming mails from outside the campaign.

Plus there is a number of things that are being put out of context like the Hillary hates Everyday Americans thing, where it's clear from the context that it is just about the phrasing

There are a lot of things that are horrible in these leaks. For example, here are four: http://www.usatoday.com/story/news/politics/onpolitics/2016/...

From those four, the following are "verified" by the OP of this thread.

    - 5205: The Clinton's seem to have had access to the questions to a debate.
    - 4178: The Clinton's seem to have been advised about the investigation into their emails from someone in the DOJ.

These are two out of 4. I'll edit this if someone links other articles and I'll check them across this link.

The DOJ status hearing is one of the perfect examples of something out of WikiLeaks that was way blown out of proportion by tweeting first, ask questions later.

http://mediamatters.org/research/2016/10/11/nbc-reporter-sug...

http://www.politico.com/blogs/under-the-radar/2016/10/trump-...

On the debate thing, a Bernie senior aide came out and said that she gave guidance to Sanders campaign too. The most nefarious scenario would be that Brazile gave questions to Clinton to prop her up. The less nefarious scenario would be that Brazile from her DNC position tried to get the best out of both candidates to not embarrass the DNC.

Note that Brazile and CNN are still denying she could have gotten access to the townhall questions. I agree though that networks should not put themselves in these kind of conflict of interests, by hiring a political commentator that is paid by the DNC at the same time, or a former campaign manager that is still on the payroll of said campaign like Corey Lewandowski.

http://www.latimes.com/nation/politics/trailguide/la-na-trai...

"I don't think there were any real bombshells in the wikileaks emails, but still..."

Yes, there are quite a few bombshells. There are now tags of twitter about specific e-mails. If you are a Bernie Sanders fan, then the level of betrayal and cheating is astounding.

Never mind the e-mails that shows the staged violence at Trump rallies. If this was a Republican candidate, it would be criminal charge time with the Project Veritas videos as exhibit 2.

Specific examples that are in your opinion most worthy of authentication?

I'm at work so, and I'll get the rest later tonight (Twitter won't load for me now anyway):

https://wikileaks.org/podesta-emails/emailid/3023

https://wikileaks.org/dnc-emails/emailid/4776

https://wikileaks.org/dnc-emails/emailid/10808

wow, what the heck, I'll get more later but a lot of sites just aren't loading

[edit: guess its not just me https://news.ycombinator.com/item?id=12762397 ]

This pretty much just shows that some people in the DNC were kinda biased and played politics. It's literally their job to do what they think is best for the party and that seems to be what they are doing (whether I agree with them is a different matter but currently besides the point).

I'm pretty sure a Bernie Sanders supporter would say this goes way beyond that. Leaking plans from one candidate to another is beyond best for the party.

That's a fair assessment, my current thought is that it was a crappy thing to do but is essentially what the party infrastructure is supposed to do (I supported Sanders by the way). What it really drives home to me is that I wish that there was a setup that allowed more than 2 parties so if they started supporting candidates I didn't like I could just switch to a party that isn't just the exact opposite of the one I am already in. It seems to me that the winner take all nature of the current system necessitates consolidation of parties.

IDK, as a bernie voter in the primary, I don't see this as surprising or problematic, at least not if I'm reading these correctly.

Ok, nothing will shock you then. If you don't believe the head of the party giving insider information from people who were supposed to be working for Sen. Sanders campaign feeding his opponent doesn't cause you fits, then all is fair game.

anyway search #PodestaEmails14 on twitter for the rest

That third email looks like they were asking the DNC for comment on a planned article, which is a standard reporting practice.

Edit: researched more, and while asking for comment is standard practice, sharing a full article pre-edit is not.

Project Veritas has been found to be deceptive and when officials actually have inspected the claims in their previous videos they found that “sometimes a fuller truth is found on the cutting room floor.”

Project Veritas has waited a couple of days each time and released the whole video with no cuts. That little quote is the refrain spoken to dismiss the video, but doesn't take into account that they do release the whole run unlike major news channels as we found out with the creative editing Katie Couric did recently.

I wasn't aware of that. I'll have to look at the whole videos later

The basic tactic is release the clip, watch for the "its edited, that's not what I said" response, then release the full video with even worse stuff in it. I really think in this day and age, its a really good template for anyone doing investigative reporting. Plus, it works fine with click advertising since it creates two waves per video.

Well, with you putting it that way, I can't say too much against the tactic. :) It's actually quite similar to what I wanted to convince courts to allow as a default in the event that they don't already. That is to let me withhold a smoking gun on a case where they might get low charges or punishment due to technicalities. Let them argue their case with lies to the court. Then, show the smoking gun with a follow-up of perjury to keep them from dodging a significant punishment.

How feasible does that sound? I know people do it to themselves accidentally but not sure if judges would allow the tactic intentionally by a non-prosecutor.

Not sure on the court tactic, but I get the feeling the video tactic is more a "give them the rope" style that is often used in court by lawyers during examination.

As far as I know, only the prosecution has an obligation to provide exculpatory evidence. That said, if you wait to half way through your murder trial to produce the video of the one armed man stuffing the body in your trunk, that probably sets you up for interfering with a police investigation, or aiding and abetting, etc.

(Sighs) That's a good point. They mighy try to score an extra conviction on their record in same trial.

If you rely on an honest, ethical democratic process, what those fools did was astounding. Sharing values with people like Bernie Sanders is just icing on the cake.

DKIM only signs headers. This is bunk. Move along.

You're wrong. As you can see on page 31 of RFC6376, the signature clearly covers a hash of the message body:

https://tools.ietf.org/html/rfc6376#page-31

It's possible to hash only a prefix of the body by specifying the 'l' parameter in the DKIM header field, but this is unusual and the email used as example in this blog post does not use the 'l' parameter.

Reply on news.ycombinator.com