News for hackers. Stuff that matters.

A comment on The FBI stole an Instapaper server in an unrelated raid. Parent comment

Re:The FBI stole an Instapaper server in an unrelated raid by dspace on Thursday June 23, 2011 @06:24PM (#2690178)
This is more "crypto nerd imagination", a la the XKCD comic. The FBI doesn't care about the encrypted passwords because it has access to all the content in plaintext. And what else would they need the passwords for? Other accounts on other services? They can just confiscate those servers too, where the content is most likely also in plaintext.

So in this case, where the FBI is involve, using a SHA-1 hash poses no extra security vulnerability.

[ Parent | on HN ]
Re:The FBI stole an Instapaper server in an unrelated raid by spoondan on Thursday June 23, 2011 @11:54PM (#2690940)
They can just confiscate those servers too, where the content is most likely also in plaintext.

I imagine that many companies are better prepared to deal with the FBI than this data center was. I have a hard time imagining the FBI going into a Google data center and easily walking out with a few racks. But even if that's too optimistic, I doubt the FBI could go about seizing servers for very long. If nothing else, this would eventually piss off big companies who will lobby Congress to curtail the FBI.

[ Parent | on HN ]
Re:The FBI stole an Instapaper server in an unrelated raid by tankenmate on Friday June 24, 2011 @06:37AM (#2691697)
In this case since the warrant probably didn't allow for the seizure of Instapaper's servers / data you run a serious Fourth Amendment risk of any evidence within being inadmissible. That said even if it is inadmissible the FBI now know things they might not have known before. There is the obvious point that there is very little likelihood of any direct evidence of a crime in Instapaper's data, there maybe indirect or circumstantial evidence though.
[ Parent | on HN ]
Re:The FBI stole an Instapaper server in an unrelated raid by adrianscott on Sunday June 26, 2011 @06:24PM (#2699286)
"So in this case, where the FBI is involve, using a SHA-1 hash poses no extra security vulnerability."

meeeh...

remember the fbi is not a person, it's an organization. the org can have bad actors in it who might be able to access the encrypted passwords but not be able to confiscate servers.

also, confiscating a server(s) is much more visible / detectable...

[ Parent | on HN ]