英國衛報華盛頓郵報因報導 Snowden 事件而拿到 2014 年的普立茲獎後,華盛頓郵報正式公開立場,表達應該將 Snowden 弄回美國受審,而非現在大家在呼籲的特赦:「WashPost Makes History: First Paper to Call for Prosecution of Its Own Source (After Accepting Pulitzer)」。

In doing so, the Washington Post has achieved an ignominious feat in U.S. media history: the first-ever paper to explicitly editorialize for the criminal prosecution of its own source — one on whose back the paper won and eagerly accepted a Pulitzer Prize for Public Service. But even more staggering than this act of journalistic treachery against the paper’s own source are the claims made to justify it.


The complication is that Mr. Snowden did more than that. He also pilfered, and leaked, information about a separate overseas NSA Internet-monitoring program, PRISM, that was both clearly legal and not clearly threatening to privacy. (It was also not permanent; the law authorizing it expires next year.)

這從來就不是合法的問題,而是侵犯人權的問題,合法的事情在事後甚至被制定憲法修正案而推翻的事情多的是。美國的女性在 1920 年才擁有投票權 (透過「美國憲法第十九修正案」)。


英國法院認為 GCHQ 偷黑別人機器是合法的

出自「Tribunal rules computer hacking by GCHQ is not illegal」這篇報導。在 Edward Snowden 爆料美國與英國政府都在幹黑的後,Privacy International 就提出訴訟控告 GCHQ,但前幾天法院認定這樣是合法的:

Campaigners Privacy International have lost a legal challenge claiming the spying post's hacking operations are too intrusive and break European law.

The case was launched after revelations by US whistleblower Edward Snowden about the extent of US and UK spying.

接下來的戰場會變成在 Investigatory Powers Bill 上面?還是會繼續有上訴?

在攻擊時總是挑最弱的一環:NSA 對 DH 的攻擊

在「How is NSA breaking so much crypto?」這邊提到了 2012 年有文章說明 NSA 有能力解開部份的加密通訊,而後來 Snowden 所提供的資料也證實了這點:

In 2012, James Bamford published an article quoting anonymous former NSA officials stating that the agency had achieved a “computing breakthrough” that gave them “the ability to crack current public encryption.” The Snowden documents also hint at some extraordinary capabilities: they show that NSA has built extensive infrastructure to intercept and decrypt VPN traffic and suggest that the agency can decrypt at least some HTTPS and SSH connections on demand.

但在這之前一直都不清楚是怎麼解出來的,直到最近才猜測應該是 Diffie-Hellman 的強度以及實作問題:「Imperfect Forward Secrecy: How Diffie-Hellman Fails in Practice」。


We go on to consider Diffie-Hellman with 768- and 1024-bit groups. We estimate that even in the 1024-bit case, the computations are plausible given nation-state resources. A small number of fixed or standardized groups are used by millions of servers; performing precomputation for a single 1024-bit group would allow passive eavesdropping on 18% of popular HTTPS sites, and a second group would allow decryption of traffic to 66% of IPsec VPNs and 26% of SSH servers. A close reading of published NSA leaks shows that the agency’s attacks on VPNs are consistent with having achieved such a break. We conclude that moving to stronger key exchange methods should be a priority for the Internet community.

作者群給的建議有三個方向,一個是把長度加長到 2048 bits,另外一個是改用 ECDH,而最差的情況 (如果還是需要使用 1024 bits DH) 則是避免使用固定的 prime number。

在美國政府宣佈贊助非法後,Snowden 取得大量 Bitcoin 贊助

美國政府宣佈資助「反動組織」非法後 (感謝對岸發展出來這個用語,用在這邊還頗適合的),也就代表資助 Edward Snowden 非法。

而這反而引起類似「史翠珊效應」的情況發生,反而造成大量的 Bitcoin 贊助 Edward Snowden:「After Anti-Donation Executive Order, Bitcoin Donations For Snowden Jump」,原始報導出自「After Obama's cybersecurity order threatens Snowden fund, bitcoin donations spike」。

Bitcoin 的「無中央控管」以及「交易不可回退」的特性在這個事件中展現相當大的優點。


第四公民》(Citizenfour) 這部電影描述了 Edward Snowden 在 2013 年披露稜鏡計畫的過程以及後續的效應,雖然是紀錄片,但整件事情還在進行發展中。

以最佳紀錄片的身份橫掃 2014 與 2015 的獎項,包括了奧斯卡金像獎與英國電影學院獎:


前幾天發現沒跟上四月 11 日的 2015 金馬奇幻影展 (應該是台灣區的首映),昨天就跑去華山看:「《第四公民》首週上映時刻表」。


整部片子裡穿插了 GnuPGTails 這些工具,用來保護通訊的隱私與安全。以及當你可能被 APT 時要保護自己的一些手段。


英國衛報對 Snowden 爆料 NSA 的特刊...

衛報 (The Guardian) 對 Snowden 爆料的事情開了一個特刊:「NSA files decoded: Edward Snowden's surveillance revelations explained」。

首先,Snowden 爆料 NSA 這件事情的熱潮一直在延續 (一直都很精彩),而且衛報本來就是在這整件事情裡面佔有很重要的角色,由衛報做這個特刊並不意外。

但衛報這個頁面利用 HTML5 video 與大量 CSS3 效果,向全世界展示了「網站上的特刊可以這樣做!」,強烈建議有在關注這個主題的企劃,以及視覺設計的人花時間去看看整體的呈現。

以往類似的東西要嘛就是主題不夠精彩,要嘛就是呈現不夠精彩。這次因為 Snowden 的爆料已經持續幾個月了,衛報自然願意花大量的資源專訪 (於是可以看到不少 video 短片) 以及整理。在手上素材夠多,以及一流的呈現方式,造就了這個精彩的特刊。