Search found 5 matches

by treadlightly
Fri Mar 10, 2017 5:25 pm
Forum: Off-Topic
Topic: CIA Vault 7
Replies: 57
Views: 9062

Re: CIA Vault 7

Beiruty wrote:The encryption software provider would provide a back door access to the Federal Agencies and under the protection of no-see, no-tell, not-me....
It is true for almost all software providers.
This is why open source encryption is about all you can trust. Hopefully somebody spotted the errors in implementation before you downloaded it.

I don't think the NSA can crack AES256 if it's implemented correctly. That cipher leverages the one true uncrackable encryption tool, exclusive or.

It's called AES256 because the key is a 256 place binary number. That's pretty big. 1.15 times ten to the 77th power. Minus one, if you want to be nit-picky.

The Milky Way galaxy is 100,000 light years in diameter. If it were a sphere with that diameter, it would have a surface area of 3.14 times ten to the tenth power light years, a number that fits easily in 256 bits.

In fact, if my math is correct and the HP25 simulator on my iPhone hasn't been hacked by the NSA, the surface area of a Milky Way-sized sphere, expressed in square Angstroms, times 413,611,060,000,000 is what it takes to fill up a 256 bit number.

A 256 bit number is so large it could have even contained the national debt through nearly the first 90 days of Obama's third term in office, had we enjoyed his beneficence for another round.

It's that big.
by treadlightly
Fri Mar 10, 2017 1:38 pm
Forum: Off-Topic
Topic: CIA Vault 7
Replies: 57
Views: 9062

Re: CIA Vault 7

The Annoyed Man wrote:In all probability - at least for now - no American intelligence agency is likely interested in me, so I'm probably not at risk of a hack from that vector.
Quite true, but never forget Steve Jackson Games of Austin, in the dark days before the feds had a clue.

Basically, 13 year olds with Commodore 64's breached NYNEX, the New York phone company, in 1989 or 1990, and played unlawful games with the phone company. The telco was embarrassed and urged the feds to get to the bottom of it.

The FBI discovered the kids in New York had some contact with a credit card thief in Atlanta, which got the Secret Service involved. The SS wanted to show the FBI who was boss and uncovered an email dialog on a BBS-like system in Illinois with a nefarious guy called Knight Lightning who they found worked for Steve Jackson Games in Austin.

The email chatter was about universal hacking tools that would melt through Unix, VAX, any supercomputer, it would hack your Frigidaire so the light stayed on when the door shut, it would do everything, everywhere, with never a compatibility problem on any computing environment ever envisioned.

Unfortunately, the feds (at that time) were too dumb to tell they had learned about a work of fiction being written at Steve Jackson Games to support a role playing game based on rolling dice. A novel, but they thought it was all real. In fact, Steve Jackson Games had never developed computer software of any kind. Nobody bothered to check.

The Secret Service executed a no-knock warrant on Steve Jackson Games in the wee hours of March 1, 1990. Sam Sparks, the no-nothing judge who signed the warrant, is still on the bench. He may be a nice guy, but he did a stupid, stupid thing in 1990.

When Steve Jackson's employees began drifting in for work, the door was off the hinges, the premises open and unguarded, and every bit of paperwork and all electronic devices were seized.

As they drove away, the Secret Service was still unaware they had confiscated a book. More importantly in court, they had confiscated the computer hosting a BBS.

Mitch Kapor, the creator of Lotus123, and John Perry Barlow, a Grateful Dead lyricist, teamed up to create the Electronic Frontier Foundation to fight on Steve Jackson's behalf.

They won what I understand is the first successful civil rights lawsuit against the Secret Service, awarding $1,000 per each of the 300 BBS users who lost their place to peacefully assemble under the First Amendment. They couldn't reconnect since they used, as is done here, handles instead of names.

Steve Jackson was on Good Morning America, years after his raid. He'd nearly been bankrupted, and when his computers were returned they were bludgeoned into uselessness. The evidence had been abused, dropped, and mistreated in an extreme way. Nothing in the tale is a federal success story.

I've spoken to FBI agents a few times since 1990. These days the agents tasked with cyber issues are like systems administrators. They know lex from yacc, and that's great. But it's disturbing that I never spoke to one who had ever heard of the Steve Jackson Games fiasco. Not one.

A federal agent involved with communication crimes and not knowing the history of Steve Jackson's raid is like living in Texas and not knowing about the Alamo.

For more information, about Steve Jackson Games, not historic Spanish missions, read The Hacker Crackdown: Law and Disorder on the Electronic Frontier by Bruce Sterling - in the public domain to raise alarm at the author's insistence, http://www.mit.edu/hacker/hacker.html
by treadlightly
Thu Mar 09, 2017 8:56 pm
Forum: Off-Topic
Topic: CIA Vault 7
Replies: 57
Views: 9062

Re: CIA Vault 7

ninjabread wrote:The snow this year is better at Innsbrook.
But not at San Moritz.
by treadlightly
Thu Mar 09, 2017 2:49 pm
Forum: Off-Topic
Topic: CIA Vault 7
Replies: 57
Views: 9062

Re: CIA Vault 7

ScottDLS wrote:No kidding it's not convenient, before the advent of Public Key encryption the symmetric keys to the ciphers had to be physically passed (like a OTP) between Navy ships, shore, Army units, etc. If someone lost the key material in battle, or if the North Koreans seized the ship, or if you had a traitor like John Walker with access to your crypto, boom your done...

The solution after John Walker and before PKI was "two person control"....i.e. LT Butthead watching ENS Beavis.... I'll let you guess which one I was.... :evil2:
Can you imagine the global crisis if anyone ever figures out how to quickly determine two prime factors for arbitrarily large numbers? One math breakthrough and the world would fall apart.

Setec Astronomy/Too Many Secrets...
by treadlightly
Thu Mar 09, 2017 2:18 pm
Forum: Off-Topic
Topic: CIA Vault 7
Replies: 57
Views: 9062

Re: CIA Vault 7

I don't understand why all those idiots in various government agencies - like the state department - don't use endpoint encryption. If your messages are stored in plaintext, you should be willing to shout them from the rooftops.

It also pains me that so many people seem to think a web site accessed via https (encrypted) connections is a secure server.

It might be, it might not be. Https just means the connection is secure. The data in flight to the server is pretty secure. Once its stored on the remote server it may be completely public. You just don't know.

As far as crypto that's completely uncrackable, even by the CIA, no problem - but you can't have ultimate convenience and ultimate security.

The CIA can't break a one time pad. You just have to communicate the pad separately from the ciphertext. Not convenient.

And don't get me started on election security. None of the right questions are being addressed.

Return to “CIA Vault 7”