Hacker News Reader

Comment by Amadou | Hacker News Reader

The problem with a positive control system is that he's being watched, intensively. So how do you reset that env variable without someone seeing you do it and thus discovering the server? Once they know the servers, they just need to take them out and the deadman's switch is neutralized.

If he had a way to do one-way broadcasts, like over the radio, where any snoopers could not discover the receivers then it would make more sense to do a positive control system. But there really isn't a mechanism for that on the internet. Even if he posted to usenet, given enough time, a sufficiently motivated nation-state adversary could probably trace through enough usenet servers to figure out what clients were looking for those reset messages.

View on HN

The server might be watching something else. Maybe he has an account on, say, Slashdot, and the server watches his account login date - if that account doesn't log in for a week, the switch gets tripped. Perhaps there's a series of such websites, and any of the requisite accounts will do? The actual server with the deadman switch doesn't need to be accessed frequently, or perhaps at all.

I think the point is that if the variable isn't being changed, the emails go out.

Maybe a packed Tor client + desktop application that does every action it needs to do for the user, if the master hasn't changed the server variable or if it's not accessible for [insert random number] days, weeks or years.

Right - so why not figure out how to spoof the Snowden-switch-update via MITM attacks thus preventing the release regardless of what happens to Snowden the human.

He could use a rotating hash based on a private key, and so no way to predict the next hash.

My take on how this works, in summary: he distributed something totally unrelated to some people, quite a few of them, not even friends probably, with the instructions to do some non-specified action with that thing if something bad happens to him. Those non-specified actions on those non-specified things, once done together by a minimum number of different actors, act as the famous dead man switch, which is therefore impossible to intercept via MITM attacks and impossible to beat,even by torture, because every actor could only know his/her specific action. For what we know he could even have "outsourced" the whole setup to someone who then fleed/changed identity, this way not even him may be able to tell what actually has to happen in order to trigger the release of the documents.

[edited for clarity]

Interesting idea, but now you have multiple points of failure. All you would need to do is neutralize one point, and the whole system fails.

Actually multiple persons in my idea were added just for the sake of redundancy, namely to avoid that the disappearance of someone involved would stop the process as a whole. The system in my opinion will then always work if the minimum number of actors is present.

You pretty much nailed how it's done, good show for off the cuff. Encrypt file with large symmetric key. Slice into n pieces, where n is like 5-10 or more. Distribute a few copies of each slice to reliable people unlikely to directly conspire. Distribute encrypted file widely. Give instructions on how to gather as a group based on some basic trigger. The chance of the gathered group missing every copy of one of the slices is pretty low as long as nobody gets a master list of key holders.

No, you can do N of M encryption using Shamir's secret sharing.

He could use something like Twitter for his reset messages. I don't think there's any way someone could find a PC somewhere listening to Twitter among all the others... Or he could post comments on HN :-)

Reply on news.ycombinator.com