Hacker News Reader

Comment by wyager | Hacker News Reader

Can you please provide sources? I verified a many of the DKIM headers myself and they were all fine. This was actually one of the strongest pieces of evidence in favor of the legitimacy of the emails. Also, I'm not sure why you say "it's well known"; it's not known to me, and I'm fairly interested in this area.

View on HN

> strongest pieces of evidence in favor of the legitimacy of the emails

Well the DNC is pretty open about the fact that they were hacked, and there's implants on their servers, so clearly someone took control on the email server. The presence and accuracy of DKIM headers is solid evidence the emails are from the hackers, but not necessarily of their legitimacy. If they had complete control of the email server, then they would have access to the DKIM's private key, making it trivial to spoof emails.

So yeah, definitely from the email server, but that doesn't necessarily mean it's authentic. Though IMO it's likely authentic, the DNS as far as I know hasn't challenged the authenticity of any emails, and I were forging emails I'd make them a lot more damaging than what we've been given.

Hey,

It's definitely been some time, but I noticed (personally verifying DKIM records) that a good chunk of the Podesta emails didn't pass. I'd have to dig out those exact emails again, unfortunately.

This probably isn't a claim you should be making without evidence.

I checked DKIM records and they did pass. Many emails did not have DKIM headers, but I never found one that contained DKIM headers, and failed validation.

Hmm, interesting. I'm now downloading the archive and going to run through and check again.

Edit: Huh, guess Wikileaks has a hard 40Mbit down limit for downloads, this might take a while.

Edit 2:

Not sure if this is due to time since leaks, and weirdness, but one such email I found was https://wikileaks.org/podesta-emails/emailid/41063

    dkim.ValidationError: body hash mismatch (got xYeNHE1y7S7c90FEmj0Clvuu8UkskqNWL3LiuMxCrsc=, expected SFTNrt5rWQXzb3TEj9vxbo/FLGDSOiYFg+04PjFRv3A=)

While I'm finding valid headers, I'm finding a good portion of negatives too. I have to sort through the spam emails in his inbox first though (lots of irrelevant DKIM failures).

Edit 3:

Just some numbers (which are definitely inflated from the spam emails I found, by how much I'm not sure):

  root@ubuntu-512mb-nyc1-01:/mnt/volume-nyc1-01# cat output | wc -l
  9981
  root@ubuntu-512mb-nyc1-01:/mnt/volume-nyc1-01# cat totest | wc -l
  28024
  root@ubuntu-512mb-nyc1-01:/mnt/volume-nyc1-01# ls out/ | wc -l
  50887

Edit 4 (and the last):

The quick script thrown together to put numbers together, https://gist.github.com/Omeryl/c6cbe603721f5671b9056ca127399.... I don't have the time to go through and see how many of those messages are spam that are just failing to validate, etc. It's worth noting that some messages may be failing to validate because x= is past, etc, as well.

Someone tested several on Reddit using two different validators. There were some that failed validation with one of the validators. Details are in the document linked to in the Reddit submission. Here is the Reddit submission: https://www.reddit.com/r/WikiLeaks/comments/58w8nh/the_podes...

Yeah, but the author claims that they are valid at the end of the post. Also see:

https://www.reddit.com/r/DNCleaks/comments/58v1if/dkim_verif...

I mean, you can go verify it yourself. This is the way I feel: even if some of them are valid, what prevents someone from adding in a bunch that aren't? Just because some are valid, doesn't make the entire dump valid imo.

Do you realize what you're saying here?

This is a huge claim, and if you can verify it, it will be very big news in the (fairly dedicated and savvy) communities that follow this.

Additionally, it's possible to provide airtight evidence to demonstrate this huge claim.

> I'd have to dig out those exact emails again, unfortunately.

Something of this magnitude is probably worth the time.

Hey,

I did write up a little bit below in a comment, before your post:

https://news.ycombinator.com/item?id=14573981

Reply on news.ycombinator.com