Slashdot Mirror
The Guardian and the Wikileaks Encryption Key
rtfa-troll writes "Bruce Schneier has a good article explaining how the Guardian released the encryption key for the WikiLeaks cables and destroyed the main protection against the release of informers' personal information. The comments in Schneier's blog fill in details of how exactly WikiLeaks' secondary file security protections were also bypassed. Now the Guardian has an article that Assange risks arrest by Australia over the latest leaks, which include information about an Australian intelligence officer. They even say, 'We deplore the decision of WikiLeaks to publish the unredacted state department cables, which may put sources at risk,' and go on to state that 'The decision to publish by Julian Assange was his, and his alone,' something which seems clearly debunked in the analysis on Schneier's blog."
http://cryptome.org/z/z.7z (368MB) pwd: ACollectionOfDiplomaticHistorySince_1966_ToThe_PresentDay# http://pastebin.com/SBq9Xpsr http://cryptome.org/xyz/x.gpg.torrent (Returns xyz_x.gpg, 409MB. No passphrase yet) http://cryptome.org/xyz/y.gpg.torrent (Returns xyz_y.gpg, 88MB. No passphrase yet) http://cryptome.org/xyz/y-docs.gpg.torrent (Returns xyz_y-docs.gpg, 8MB. No passphrase yet) http://cryptome.org/xyz/z.gpg.torrent (Returns xyz_z.gpg, 368MB. Passphrase below) "xyz_z.gpg" and "z.gpg" appear to be identical and both decrypt to "z.7z." The decrypted file is "z.7z," 368MB, which unzips to "cables.csv," about 1.7GB in size, dated 4/12/2010.
They were stupid to let the Guardian to get the key in the first place but once it was out making it more available was the right call.
When you had to get the data and key together that require time, and some computer skills. People who might retaliate against leakers have the resources to marry the key and copy of the data they either already had or could get from torrents.
That might be much harder to do for some poor tribesman who has limited or intermittent access to the internet. By making the information easier to get at, it lowers the bar, makes it easier for potential victims to know if they have been outed, and need to protect themselves.
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
Ordinarily I'd be inclined to agree, but the avalanche has already started; it is too late for the pebbles to vote.
are playing a stupid game right now.
In their JA will face arrest in Australia article they earlier said something like "the Guardian unknowingly publish the password in the Guardian's book" etc,
now that phrase is nowhere to be found from the article...
The Schneier article is very speculative and doesn't have many facts.
DER SPIEGEL has a much better and more detailed account: http://www.spiegel.de/international/world/0,1518,783778,00.html
They said the same thing about the US-Iraq/Afghan cables a few months ago, then later it was shown that there really wasn't any information that would get people killed. I'd wager it's the same situation again--someone got caught with their pants down and they want (Assange's) blood for it.
With any luck they'll all be politicians.
Any foreign intelligence agency worth its salt would already have had access to this information. All the release has done is let the proles take a peek behind the curtain - nobody is going to die because of this.
So whatever happened to books, or the relevant chapters, being given out privately to the people in them prior to publishing? I thought that was standard practice.
I suppose it got put to the wayside since it was only relevant when the concepts of truth and balanced reporting were practised. As far as papers go, the Guardian is still far from the worst offender, but it used to be a high quality liberal broadsheet. The last few years it has seemed to put most value on web hits over quality paper journalism. Sensible liberalism has given way for sensational liberalism.
That;s why I don't buy it any more.
The cat's out of the bag. People will still read these, despite your baseless FUD.
This is not the Wikileaks insurance file, which remains encrypted.
This is a different file, that the Guardian was privy to, and was then mirrored.
The password to this other file was published in a book.
I only mention this because the previous /. post on this topic had a lot of replies with the mentality that wikileaks has surrendered its insurance. Such is not the case.
Among other revealations during this ordeal, one thing stands out - I now know how morally bankrupt main stream media have become, irrespective of how right or wrong assange is.
Guardian won awards for all the work done by wikileaks/manning, and now they just backstabbed them, and still have guts to defend their own actions.
NYT is even worse.
Whisleblowing investigative journalism is dead, sold out to big governments and corporations.
Why should the top whistleblower service encrypt their files in .z7 format? - OMG!
There's truecrypt, gpg, openssl etc. out there!
some of these cables describe people being wrongly killed.
The redacting that was done by The Guardian and others was just a reasonable thing to do, but it had one disadvantage: They published only selected and redacted cables and such you couldn't look for certain things by yourself. There's been more interesting stuff in the past centuries than The Guadian or Der Spiegel would recognize.
What's now possible is others sieving through these cables and I'm pretty sure that people will find interesting things. While it's not really a good thing for names of informants being published all this centralized knowledge and decisionmaking about what is good for the public to know is really getting on my nerves lately.
and secrecy. it is the history of the twentieth century.
Patrice Lumumba being a perfect example.
im not saying Wikileaks did the right thing, im just saying to be 'outraged' is a little hard to understand.
"...and go on to state that 'The decision to publish by Julian Assange was his, and his alone,' something which seems clearly debunked in the analysis on Schneier's blog."
Neither the media nor law makers will ever let the facts get in the way of their objectives. And because law enforcement has no small stake in this, either because their own fat is in this frying pan, or due to marching orders from the law makers, neither will they.
[End Of Line]
is guilty of torture?
I thought that the original leak by Bradley Manning was a brave thing that he did, especially since the information he chose to leak was only low-level classified and unclassified information. He should be given a humanitarian award for his role in this.
Then I thought that WikiLeaks sharing the diplomatic cables with select journalists at respected organizations so that they can review the material, redact and sensitive personal information, and then publish a well written analysis of the most interesting cables was also a good and respectable thing.
However now that I find out from the Spiegel article that the shared file to the Guardian was just left on the file server after the confirmed that they got it is just such a stupid mistake. Encryption is not the be-all-end-all answer to security and WikiLeaks failed to understand that. Also the password was long and complex but the phrase shares the context of the data it encrypts and also could have been guessed eventually since it had so little entropy and difficulty.
Then to hear about pool record and file keeping, copying files to another server, hiding in subfolders, then copying them back and sharing them out on BitTorrent, what a cock-up that was! It's like the story of so many people on older P2P platforms sharing out their entire hard drives without realizing that people were download their application password files, personal documents, tax returns, pictures, and other stuff that should never be shared. It makes me think that WikiLeaks lacks some common computer sense and good server administrators who maintain and clean-up crap after their users.
This is one of those Epic Fails that will affect many people now and later, and will ripple down in history as a lesson of the reprecautions of good leaks going bad due to negligence and ignorance.
Has Assange verified this? With the code breaking computers available to the US it would be possible to figure out the key and impersonate Assange as a very effective smear campaign. It would also put americans and their spies at risk but that's not stopped them before.
Here's an Amazon book review critical of the disclosure of the password in the book. I registered my support for the critique with a 'helpful' click.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
From what is stated;
1) The key given to the reporter was not the key for the insurance file
2) The Assange had provided a backup method for others to recover the data in the case he was a) killed, b) otherwise rendered incapable to act by other than having the group act on his behalf
3) Whereas it is easy to revoke access to content on a central server, it is impossible to revoke access to a file that cannot be changed (a password can simply not be revoked unless you can write to it) In other words you cannot revoke passwords for content that is available on bit torrent etc.
4) The way encryption usually work is through two sets of keys, i.e. LUKS. The real key is essentially always 512bits, but nobody including you ever use this key - you have a password and a separate key that releases the 512bit key!!!
No, we do not know if there was a second pass-phrase key on the content provided to the reporter, but if it was, having one key which gives access to the full 512bit key and content might be used to reveal alternative keys to get the real key. One of which might cascade to the key used in the insurance file. Which is why it was truly irresponsible of the reporter to publish the key regardless!!! That is as far as I see neglect, and being clueless is under no circumstance justification. Yes, the password could be revoked on access, but any backup prior to revocation can as stated above would retain access with that key whether it is a tape, an USB copy, or bit torrent.
Anyway, it is not for sure there where any alternative keys combined with that content, however, we do know the group had access to release the content of the insurance file in case something did happen to Assange anyway...
That the Insurance file was released on Bit torrent was most certainly not a mistake, however, it will have been a mistake if an alternative key used on the content given to the reporter could cascade to this key somehow. (From what I have learned of the case, I kind of don't think the problem was here).
So that leaves the people who where on the inside with the knowledge necessary to release the key...
Sure, there has been a lot of mistakes happening; we can blame Assange for believing in the fools who left for OpenLeaks. They were likely always the number 1 threat to the whistle blowers: Internals who sabotage, steal and try to destroy the original organization with internal knowledge.
people said wikileaks would cause casualties. well, its been a year+ since alot of this stuff was released. who has died? can anyone name a single person who has died so far?
"Destabilising sensitive negotiations and compromising sources will almost certainly result in more deaths, though, not just for the sources and their families but because the work they were doing was undermined."
im not saying i dont believe you. im just asking for evidence.
there are a lot of kids in pakistan who have died because of drone strokes. they didn't "theoretically die", in the mind of some internet blogger, they actually died, in real life, with their guts hanging out all over the floor, screaming for their parents who were probably splattered all over the adjacent wall.
why should i be more concerned over something that theoretically, might happen, (and i have been waiting a year for it to happen) versus something that happens every other week, in reality? this is my problem with this argument. this is where i fall down actually giving a shit about the 'crimes of wikileaks'.
Here's an Amazon book review critical of the disclosure of the password in the book. I registered my support for the critique with a 'helpful' click.
Did you think that through? If you get this review marked as the top negative review it will plainly tell everyone the real world password is in there and probably generate far more curiosity than outrage.
So many things went wrong here it's hard to say where it all started. No one knows where it will end either. The laws of unforeseen consciousnesses and/or just plain old Murphy's law leads me to believe this is far from over.
Everyone involved needs to be rounded up and held accountable though.
I think the difference in this "outrage" is whether the dead are "them" or not.
1 potential threat to even one of "us"
is worth far more than
1,000's of actual injuries or deaths to "them".
sucking off males.
No wonder.
They're all a bunch a snits.
Serve'vm right I'd say. Nigger snits.
--//
Condescending? This is the word you use to describe the attitude toward the guy who told the password to the world?
Take off every 'sig' !!
One of the primary objectives of wikileaks, is to present this information in a way that is not illegal, and to protect the identity of the people involved. It's one of the reasons it has been so successful, as opposed to Anomalous... Those kids are headed for trouble, and I certainly do not condone their actions...
There are no hidden agendas, it(wikileaks) is for us, the people of the world, we diverse to live in a world that is not governed by the greedy and morally unsound...
As for this current slip-up, I think I'm safe to say that, it is NOT the intent of wikileaks to undermine it's authority and legality, and in no way should this action compromise the continuing objectives of the movement.
Just don't forget that there are many people with vested interested; those that oppose the idea generally have something to hide, and more often than not, they have the power to manipulate and influence, in this instance, I see reality distortion and a bit of sabotage thrown into the mix for good measure...
Just another day in the mud for wikileaks!
They made secure efforts in transmitting the data. It was the Guardian that betrayed the trust of Wikileaks and all those identities that were suppose to be withheld. The Guardian kept the data file and let it leak and then published the password... In effect the Guardian published everything in the clear. They are the ones to be held responsible.
David Leigh and Dumbshit-Borg are either pathetic and self-serving dupes, or sickening quislings
Indeed. According to Der Spiegel , the encrypted file was among those taken from Wikileaks by Domscheit-Berg when he acrimoniously left to start his own rival Openleaks site. It was then released by Openleaks using volunteers to seed torrents of many of their files. Meanwhile, David Leigh of The Guardian published the password which Assange had given him, thereby apparently breaking an agreement of confidentiality. Later, an Openleaks-associated news site let people know where the key to this particular file could be found.
Smelly sticky shit is indeed flying, but it looks like a side effect of Assange/Wikileaks being stabbed in the back by Domscheit-Berg/Openleaks and David Leigh of The Guardian. Whether the stabbing occurred by coordinated malice or combined stupidity and incompetence is still a little uncertain. Either way, it's hard to blame this directly on Assange/Wikileaks.
Those who can make you believe absurdities can make you commit atrocities. - Voltaire
Just reading through a few of the cables that have leaked regarding my country and I came across several cables that have named names of sources with the tag "(strictly protect)". Now, in my country, their lives are certainly not in danger, but their jobs certainly are.
The biggest achievement of cablegate would be to make everyone think twice about talking to any US diplomats.
The Guardian G/Men Group are quite covert. As always a journalist will befriend you to get a scoop, yet disrespect you later.
Of course most people 99.9% of /. users will not understand what G/Men is.
All cows eat grass!
This man is the chief investigative editor for the Guardian but did not know how to unzip the 7zipped file. That was stupid enough, but he then published the password of the archive as a chapter header in his tell all book.
The Guardian relies on the kind hearts and foolish whim of liberals and misfits to sustain itself. If not for them it would have sunk without trace long ago. It certainly isn't the quality of the investigative writing.
Releasing the previous password may give some insight into the password of the insurance file. Instead of having an unrelated or random password, Assange used a phrase relevant to the content with common capitalization and a symbol at the end. Is this his habit, or a one-off breach of best-practices for security. It's a lot easier to try phrases related to Assange, WL, revenge, insurance, imprisonment, etc than to try to walk the 256-bit keyspace. It's social engineering without needing to be social. Beating the human factor is easier than beating math.
namely, Vietnam.
Being a US citizen, am I in any legal danger if I look at the above mentioned leaks? Yes, there are probably 1000's of journalists looking at them, but I'm a lowly citizen with no clearance whatsoever. I reasonably ask this, because honestly, I don't know the answer anymore.
I've read that same work; it's a solid dissection of the authoritarian phenomenon, from both sides -- those who cheer on the bullying leaders, and the bullying leaders themselves. It's not terribly short, but not overly long, and it's actually written in an approachable and reasonably legible style, which is unusual for high-end academia types. Well backed up, with footnotes and a bibliography for those so inclined. The author also explicitly released the book online for free, out of the view that he wants his findings as widely available as possible.
Worth the read. That's my 2p, anyway.
Cheers,
"What in the name of Fats Waller is that?"
"A four-foot prune."