Hacker News Reader

Comment by dublinben | Hacker News Reader

There have been several important legal cases that would have significantly benefited from cracking the defendant's TrueCrypt volumes. To my knowledge, these attempts have all been unsuccessful.

If the NSA has a backdoor, then they're not sharing it with other law enforcement agencies, and keeping it a better secret than everything else they were up to.

View on HN

I would assume the NSA has a variety of backdoors they do not share with other law enforcement agencies.

It was actually surprising to me that they shared ANY of them.

This is how intelligence agencies work -- they want to keep it a secret what they can crack, so the adversary will keep on using it, and they can keep on cracking it. For intelligence purposes.

Intelligence is different from law enforcement. Or at least, it used to be. In the US, theoretically the constitution means you can't use secret evidence against someone in court. But of course you can use secretly gathered intelligence for polticial/military/geopolitical purposes. The merging of intelligence and law enforcement is not unrelated to the push to keep more and more legal proceedings secret -- a significant threat to the constitution.

We only know those things that we know. The NSA must still have some secrets.

Quite right. I wouldn't entrust my life to TrueCrypt, and hope nobody else would either.

So what would you trust your life to? If you are a dissident, what products and procedures would security professionals suggest?

They'd be hard pressed to recommend any off-the-shelf products or practices right now? Because PKI is in shreds, nobody trusts trucrpyt, and TOR users have been rooted left right and centre recently.

With my life? If a security vulnerability would be life threatening, I would not trust anything on the internet, I'd keep it off the internet -- and maybe even keep it off computers entirely. (Although if they can get physical access to my non-internet computer, they can get physical access to hard copy notes too, of course).

Yeah, that's hella inconvenient. But not quite as inconvenient as being murdered or disappeared to a torture prison.

So how exactly would you communicate, share files and information if you were organizing an uprising for example?

You can't always physically transport those files, and sometimes it may be more dangerous to do so (if you are wanted person for example). You also have issue if you are having those files transported cross border then you may get border issues (Philip Greewalds partner being help in UK). For speed and ease, it would have to be via the internet somehow. For higher security, it would have to be non-network connected computers and via USB. For even higher security it would be non-computer but then I would have to memorise everything and I don't have a photographic memory :(

I'm not sure what I would do in this case either tbh.

How did people organize an uprising before there was an internet?

Or, perhaps, yes, organizing an uprising neccesarily means risking your life.

But here's schneier on air gaps for his recommendations against protecting yourself from very powerful attackers. https://www.schneier.com/blog/archives/2013/10/air_gaps.html

Compare and contrast with the internet bringing democrazy and the Arab spring...

They can always use the backdoor themselves and use the information decrypted to provide hints to local law enforcement on where to look for evidence via parallel construction

That's what I was thinking about.

Reply on news.ycombinator.com