xnull

Couldn't it both be true that Microsoft weakened Bitlocker by removing Elephant AND that AES-CBC + Elephant isn't good enough (e.g. lack of integrity)?

We might discuss how to best design FDE, or whether FDE is what we want.

But that conversation is orthogonal to the fact that AES-CBC is weaker than AES-CBC + Elephant, which is what we are talking about here.

Your criticism comes down to: "CBC + Elephant may be stronger than CBC, but neither are strong enough for me". I agree with this.

AES CBC + Elephant != XTS

Elephant 'mixes' the blocks on a sector level to limit CBC block modification attacks. It does not limit the maximum size to align to sectors. It is not XTS.

Nor is my claim that Elephant is what you want or need. Merely that it was removed, that Ferguson designed it, and that FIPS compliance was the underlying justification.

And an unlimited amount in PRISM.

"Beginning March 7 2013, PRISM now collects Microsoft (One)Drive data..."

http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPl... (27)

Well no.

It went more like this:

Does HN really believe in UFOs? Let's assume for the time being no.

Is the sudden influx of UFO articles then based on HN popularity or is there a campaign to introduce this content (these campaigns are common, although I do not know how popular on HN)? Let's assume for now that the articles are part of a campaign.

What group with what motivation would benefit from said articles. My first thought here was in fact TLAs/spooks. But only on entertaining the hypotheticals.

A 'viral campaign' for a UFO movie is also pretty reasonable, IMO.

If you were to entertain the two hypotheticals, what would you think?

Yeah I do. Although it is pretty tame on the spectrum. Certainly it is a more reasonable speculation than alien contact (low hurtle to jump).

For the record I don't believe this is the case. I do reserve the right to adknowledge it as a possibility with a small posterior probability in anticipation of additional priors.

"Planned Research

There are three components of our proposed research focusing on persuasive messaging, norms-based influence, and social media effects respectively.

1. Persuasive messaging-based influence

2. Norms-based influence

3. Neural predictors of Twitter impact in Cairo"

http://minerva.dtic.mil/doc/samplewp-Lieberman.pdf

"Here we report results from a randomized controlled trial of political mobilization messages delivered to 61 million Facebook users during the 2010 US congressional elections. The results show that the messages directly influenced self-expression, information seeking, and real world voting behavior of millions of people. Furthermore the messages not only influenced the users who received them but also the users' friends, and friends of friends."

http://jhfowler.ucsd.edu/massive_turnout.pdf

Maybe. Hadn't thought of that.

My first though was spooks trying to discredit the reputation of the community as 'paranoid' and 'fanciful' given all the good and informative conversation regarding Snowden and other disclosures here lately.

Crossing my fingers a good UFO flick is on the way.

What's with the recent uptick in UFO article postings in HN?

It's worse than 'can technically look at it'.

https://en.wikipedia.org/wiki/Third-party_doctrine

https://en.wikipedia.org/wiki/Stored_Communications_Act

https://en.wikipedia.org/wiki/Communications_Assistance_for_...

You mean that by design Tor acts as MITM, and that end-to-end crypto should be used to provide integrity?

The major users of Tor need to consider even their ISPs as an adversarial agent - that they are being actively monitored and MITMed. In this sense, these users are not trading security for anonymity.

For those who trust their telecommunications carriers (in the US even in the face of CALEA) - they are certainly introducing a MITM. It's also important to note that the linked article considers the 'security bug' to be owned by software updaters and software vendors that that do not sign binaries - the vulnerabilities are not specific to Tor, but it does provide one mechanism to exploit them.

This is all a good reminder, as the Tor team themselves regularly say, that secure operational browsing and software practices are crucial to anonymity and security even with Tor installed.

Facebook has a lot more information about you than what you post and 'privacy controls' presumably limit who gets access to the information you do. Both of these things are being abused.

What we are talking about here is something very different than your neighbors and acquaintances learning more about you.

Trade-offs for sure.

On serious topics I like to avoid clouding the message with satire.

The Onion's article is great - just remember that the situation is no joke.

It's called "key escrow" and there are tons of ways to do it.

Look up US patents under 380/286 classification.

Uh, yeah how about NSA's access to TEMPORA.

Your post is a classic example of shifting the burden of proof. You are the one with the belief that contradicts documents, leakers, whistleblowers, journalistic reporting, senatorial reports, US history, partner documents, and on.

Or if you need more direct links look through the other branches of this thread. Plenty of evidence, much of it directly from the Congressional oversight committee itself.

The nonsense comes from trying to reinterpret a small number of slides and to then broaden that interpretation to a expansive umbrella.

It is simply truly the case that the NSA and partnered agencies have broad access to sweeping untargetted collection of data.

Why not PAKE?

"The SRP protocol has a number of desirable properties: it allows a user to authenticate themselves to a server, it is resistant to dictionary attacks mounted by an eavesdropper, and it does not require a trusted third party. It effectively conveys a zero-knowledge password proof from the user to the server. In revision 6 of the protocol only one password can be guessed per connection attempt. One of the interesting properties of the protocol is that even if one or two of the cryptographic primitives it uses are attacked, it is still secure. The SRP protocol has been revised several times, and is currently at revision 6a."

You can salt/password manager/email retrieve on the client side however you want to strengthen you passwords or escrow keys without needing to share state with third party services at all. And they never get a copy of your creds. The server side can easily rate limit guesses per account, report access times, and/or require CAPTCHA challenges.

https://en.wikipedia.org/wiki/Secure_Remote_Password_protoco...

This should not have been downvoted.

"The company, which in 2010 blamed China for an attack on its computer networks, said it recently discovered the Gmail campaign, which "appears to originate from Jinan, China," and targeted specific individuals." - http://americanpowerblog.blogspot.com/2011/06/china-hacks-go...

"Chinese hackers who breached Google’s servers several years ago gained access to a sensitive database with years’ worth of information about U.S. surveillance targets, according to current and former government officials." - http://www.washingtonpost.com/world/national-security/chines...

I think we've exhausted this branch of this topic, but I'm sure we'll have an opportunity to discuss this further on other Snowden articles and I look forward to doing exactly that.

If you remember in 2010 China hacked into Google's infrastructure and gained access to the interface and databases set up for US intelligence surveillance.

China can and does filter content at a packet level and TLS 'strong encryption' doesn't protect you when CAs are both owned by the government, proprietary Chinese drivers run on Operating Systems, the large companies provide hardware backdoor access to the government (US bans Lenovo for government use for this reason), and networking companies likewise provide all hands access.

Just like any other internet service, China can filter FB/Google content directly - though it is easier with partnership and alas FB/Google has allied themselves with the US.

To some degree.

The US government nudges public opinion (Fallujah PsyOp, Judith Miller, Ken Dilanian, operation MOCKINGBIRD, purposeful placement of objective aligned messages on international media lines, "Heroes in Error", partners with astroturfing services/HBGary).

It breeds capabilities to influence individuals and groups (NSA JTRIG, GCHQ BIRDSONG/BADGER/GATEWAY/SLIPSTREAM/ETC, MINERVA) and will wield capabilities to track and target information to groups in limited circumstances ("The Cave").

It also will quiet groups, even if they are domestic, that significantly challenge the stability or justifiability of the nation/system/structure (COINTELPRO, MINARET, Fusion Centers).

This is a fallacy of the excluded middle. If the blogger was in fact a domestic blogger (was it?), it can in fact be both about domestic efforts to organize and international influence.

The United States and allies have other ways of handling domestic movements, like Fusion Centers and Free Speech Zones (in the US) and partnerships and leverage on media providers.

It kind of is though, isn't it?

Isn't assassinating Mostafa Ahmadi Roshan different than assassinating John Doe?

Of course it's censorship. Turns out there is a spectrum to censorship too - like most things, it's complicated and refuses to be black or white.

The blocking of Facebook and Google is directly related to PRISM, social contagion theory, international surveillance, and weaponized media.

These issues are extremely complex and no single article or HN comment is going to cover it in it's entirety. I think the second bullet point is awfully good justification for China to have a 'less free internet score'. I'm definitely not going to claim that China doesn't engage in domestic censorship outside of international pressures - I believe they absolutely do.

But that's a different issue and not what I was trying to establish. In part, the comment is a good opportunity to alert people who don't understand that weaponization of media (psyops warfare) is prevalent on the internet today - including the 'free countries'. Thankfully, readers will observe this section of the thread and get clarity. :)

Nope, just providing some information to contextualize policy decisions by various countries.

Who said I'm justifying China's policy, or what I "dislike America"?

I'm not passing moral judgement or making normative claims about goodness or the badness, etc. What I am doing is explaining the incentives that these countries are responding to - showing you not just where the actors are but how the stage is set up. Policy does not exist in a vacuum.

This is interesting. Allow me to provide some counterpoints to the bullet points listed for a few (major) countries.

China:

* The Great Firewall of China blocks people's access to many websites, e.g., Facebook, Google.

* Government engages in extensive censorship especially related to political organizing or protests.

* Foreign social media apps are banned. Users must use real names on social media.

The Great Firewall and the blocking of media apps does also function as a Firewall. It is not merely a censorship technology. The United States and allies are known to target media in other countries to stir dissent. Radio Free Europe, "Voice of Iraq" (cough American), the Lincoln Group infiltrations and partnerships, etc.

The Snowden leaks and the history of (especially) Google but also other US businesses in China (and export exceptions limiting the purchase of infrastructure technologies) tell a tale of the US trying to export compromised services to China. China does not want its citizens' informations in America's XKeyScore nor it's citizens Google, Microsoft, Apple, Facebook, etc data in America's PRISM. (There's a reason all of those programs get permission through the FISA "Foreign Intelligence Surveillance Act" Court).

Just this past year the CIA (under USAID) pretended to be a grassroots movement on Twitter served 'news' critical of the Cuban regime that nearly caused a Cuban uprising.

The DoD's MINERVA project specifically looks to understand the cultural components of stability of various countries and mechanisms to encourage or disrupt that stability. Among a great number of social studies you will find DoD research on how to seed information inside of specific Asian countries, including China, for the targeted introduction of instability. I will leave speculations of possible connections to the Hong Kong protests to the reader.

http://minerva.dtic.mil/funded.html

It's a global issue right now. This year Egypt sentenced Al Jazeera journalists that they believed were partnered with geopolitical interests of other states.

As of this year Putin is now requiring bloggers to register if they have a certain number of readers, so that his administration can curtail international influence.

America, too, faces challenges. A number of journalists have called out that the state has been extremely aggressive to dissenting opinions, even to go so far as labeling current policy on the issue "War on Journalism". American officials have exported a number of journalists with Middle Eastern descent and journalists like Ayman Mohyeldin have been pulled from Gaza and other conflicts when reporting has erred on the side of other state interests.

And of course there's the article "I Liked Everything I Saw on Facebook for Two Days", which is definitely worth a read. The TL;DR is that below the thin surface of social information bubbles enormous amounts of radicalizing geopolitical and domestic political ads and campaigns.

http://www.wired.com/2014/08/i-liked-everything-i-saw-on-fac...

Dropbox was revealed as a participant of the PRISM program: anything you store there is searchable. The same is true of Facebook and Google and Yahoo, Apple, all cell phone carriers, all internet carriers and other cloud storage companies including Skydrive/Onedrive.

"This is a major leap forward in the NSA's ability to exploit Facebook using FISA and FAA authorities" - NSA

"...by exploiting inherent weaknesses in Facebook's security model." - GCHQ

http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPl...

That's Facebook. The Yahoo and Google stuff has been very widely reported and are direct from Greenwald and the Snowden leaks. Other links (in particular the PKH link) contain other information.

http://www.washingtonpost.com/world/national-security/nsa-in...

Found the reference to Israel/France, looking for Germany references.

http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPl... (pg 40/125)

Why the downvote here? The comment contributes to the conversation...

Addendum: we help fund partners programs.

http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPl... (pg 124)