Hacker News Reader

Comment by INTPenis | Hacker News Reader

Any single API for this would be constantly attacked.

They're distributing the attack surface by using other services.

Let's not exaggerate. There are APIs that distribute the list of oblasts (regions) that are deemed to be under attack (for example https://alerts.com.ua/). The only problem is that you don't know if the attack is expected in 10 minutes, or 6 hours, and this is something that the military intelligence has, and could share with a small amount of effort. They effectively already share it via people running those channels.

Also, nothing stops you from redistributing the structured messages through multiple channels.

The problem is that you let the enemy know the detail of your intel. Using compartmentalization, they can locate leaks and determine how you are getting the intel.

As a military, you never want to give that away. Looking at WWII, the UK/US were able to decrypt messages daily from the Germans (thanks to Turing!), but they pretended they couldn't so the Germans wouldn't change their encryption scheme.

This is a significant mistelling of the history of the German "Enigma" device. Significant usage of Enigma was done during the war in a manner that was secure enough to prohibit interception.

Turing's methods are brilliant as are the contributions of numerous other cryptographers. They relied on numerous operational failures of some branches of the military to be possible. So it was not from "the Germans", but from specific branches of the military that failed to follow already established best practices

I'm not sure what you mean. They used daily weather reports to decrypt the enigma for that day, so I'm not sure how that is an operational failure. If you know part of the cleartext, it's possible to brute-force any encryption given enough time.

https://www.accuweather.com/en/weather-news/how-british-cryp... gives a pretty decent summary.

Sure, but those known text attacks were made significantly easier by German operators using (and reusing) non-random and easily guessable encryption parameters. Once the keyspace became small enough to search, they were able to brute force the encryption.

You're mentioning one technique as if it was the comprehensive method of compromising the Enigma. It was not. The example you give would only work for the Kriegsmarine transmissions for example. The Luftwaffe had its own system with its own operational failings.

But they already share it, just in a messy format. No need to philosophise.

I'm not philosophising, this was literally my job in the military and worked with a number of analysts who worked on this sort of thing.

I see, but this military does share this very information.

They share enough information to be useful to the civilians but not enough information to show capabilities. If everything is automated, the enemy can subscribe to the automation and work out radar capabilities, response times, and accuracy. Those are all terrible things for an enemy to use and abuse.

Not sure outsourcing it to a Russia affiliated messaging app is the best choice then.

What would you choose?

Not an easy questions as it depends what's popular in the local market, you need to be where the users are even if you don't like it in cases like this. Telegram also has a great bot API, which makes it a harder sell to use alternatives (Signal, WhatsApp) or open technology like Matrix, where it's only useful for people that like to play around with technology and not regular people.

Reply on news.ycombinator.com