Hacker News Reader

Comment by CJefferson | Hacker News Reader

However, you do lose deniability -- if you have possession of that key, you have to explain it.

There might be more value in not requiring you keep track of a key, at the loss of some users who figure out how to unencrypt themselves (of course, I might be overestimating malware authors!)

View on HN

> However, you do lose deniability -- if you have possession of that key, you have to explain it.

Full disk encryption + encrypted VMs that are powered down when not in use + religious adherence to TOR and basic OpSec common sense -> deniability is almost irrelevant

Assuming that TOR isn't safe - which there's strong evidence to believe at the moment, and you can track down who's involved, crypto becomes as strong as the resistance to pain of the people involved.

> Assuming that TOR isn't safe - which there's strong evidence to believe at the moment

There actually isn't strong evidence here, but regardless you should be proactively paranoid anyway.

Ultimately the goal of ransomware is to obtain bitcoins, which are really just value stored in a key you possess, so this problem is nearly intractable as far as maintaining complete deniability. To say nothing of turning those coins into USD you can legally spend.

In the end it hardly matters. People developing malware like this are usually in countries that don't have any cyber crime laws, so they don't need to be incredibly good at covering their tracks to begin with.

There is no need to be in possession of the private key - only put in on the C&C server or even let the C&C server generate the key pair and send out the public key on request.

Reply on news.ycombinator.com