Hacker News Reader

Comment by scotchmi_st | Hacker News Reader

I can see 3 possible scenarios here.

1. Russia/China have got hold of the files, and know how to decrypt PGP (Very unlikely).

2. A journalist with access to the files and the encryption keys has left them lying around, or was cooerced into decrypting them. (Unlikely but possible).

3. Intelligence services are lying, possibly for political gain ahead of new legislation (specifically in the UK), and/or have fallen for a bluff by China and Russia. (Most likely).

View on HN

4. A version left encrypted at any point and time on some old SSD or NAND cells that were then recovered, without journalist or other handlers aware this could happen.

5. GCHQ or NSA had same or similar documents lifted (umm... leveraging Office of Personnel Management or a similar type hack) and they are preparing a cover story.

plenty of conspiracies to go around but as someone else said... until some proof is shown there's no reason to give much weight to the statement that individuals needed to be moved.

http://www.washingtonpost.com/world/national-security/chines...

I'd say its #5 honestly :p

Is it that unlikely that a journalist left the encryption keys on an internet-facing machine? The protection on an essentially unguarded computer (let's face it, if someone wants to break into any of our home machines, they can) would then be the weakest link.

poitras and the intercept are both very well versed in opsec and the necessity for airgapping, and the latter hired Morgan Marquis-Boire to handle security for first look media. i don't think it's as likely as you believe

The NSA is also well versed in OPSEC, but a guy took a ton of their documents and is currently residing in Russia. There are always holes in the system.

2. A journalist with access to the files and the encryption keys

It doesn't have to be a "journalist". E.g. I'd consider Bruce Schneier to be more of a cryptographer or researcher.

My scenario:

   1) He's had extensive access to the Snowden material

   2) He uses Windows

   3) Q.E.D.

Yes he's taken precautions, but he's certainly a "high value target".

https://www.schneier.com/blog/archives/2013/09/how_to_remain...

More likely is that the Snowden documents have been widely distributed in encrypted form (as one of the Wikileaks insurance releases) and Russia/China have managed to brute force the key.

That broadly speaking comes under point 1, and in my opinion, that's very unlikely, given that at the point Snowden stopped contracting for the NSA, PGP was still considered uncrackable by them.

This is least likely.

Snowden's passphrase[0] advice is pretty bad - perhaps they came up with a list of phrases based on what they know of him and successfully cracked it.

> “The best advice here is to shift your thinking from passWORDs to passPHRASES,” Snowden recommended. “Think about a common phrase that works for you. It’s too long to brute force and also make them unlikely to be in the dictionary.”

(emphasis mine)

0. http://rt.com/usa/248401-snowden-oliver-password-protection-...

I expect Snowden actually advocates people use something like diceware passphrases and the journalist misunderstood.

https://en.wikipedia.org/wiki/Diceware

That sure isn't what he said to John Oliver.

https://www.youtube.com/watch?v=yzGzB-yYKcc#t=1m30s

He mentioned "margrattethatcheris110%SEXY" - I would be totally unsuprised if someone managed to crack that.

Diceware is a great choice.

Perhaps you can come up with a reason why this is bad?

While I'm asking, perhaps you can come up with a reason that doesn't boil down to "Bruce Schneirer said XKCD method was bad"?

It's more that most humans are predictable most of the time. There's no reason a password cracking dictionary can't contain phrases as well, and most of the sorts of rules based permutations used against normal passwords can be extended to passphrases. Attacking a specific individual also tends to be easier - you can profile them and build targeted word and phrase lists.

XKCD is bad specifically because it is specifically talking about attacking a password via an internet based oracle rather than attacking a hash, but people generalized it. A search space of ten or twenty trillion is laughable when a few GPUs can make a billions of guesses per second against a vanilla hash algorithm.

Ultimately, if you want a password or passphrase that a computer can't guess, you should let a computer pick it for you, or if you're really paranoid, use diceware.

Most likely? Any evidence to back up that claim?

I know he communicated with the journalists via PGP but do we know that all copies of the files were encrypted that way?

Reply on news.ycombinator.com