News for hackers. Stuff that matters.
Re:Hackers are stealing data today so quantum computers can ... by cantrevealname on Wednesday November 03, 2021 @10:19AM (#29094945)
The article offers no explanation about how adversaries are able to get the encrypted data in the first place. I'm not saying it's unlikely or that they shouldn't invest in quantum-proof cryptography for the future, but it would be nice to hear about some plausible ways that data is being "harvested now". I assume that nuclear weapon design secrets aren't floating around as encrypted files on the web. One possible idea I had is that adversaries are intercepting and saving HTTPS traffic between "interesting" targets.
Re:Hackers are stealing data today so quantum computers can ... by tablespoon on Wednesday November 03, 2021 @11:11AM (#29095793)
> I assume that nuclear weapon design secrets aren't floating around as encrypted files on the web. One possible idea I had is that adversaries are intercepting and saving HTTPS traffic between "interesting" targets.

They're probably targeting communications, like those diplomatic cables Manning leaked. I'd assume top secret "design secrets" aren't transmitted. My understanding of spying is it's typically focused on gleaning information from sources a laymen would consider boring and/or useless. For instance, the NSA worked until 1980 to decrypt certain Soviet messages sent between 1942 and 1945 that re-used one-time pad pages:

https://en.wikipedia.org/wiki/Venona_project

Re:Hackers are stealing data today so quantum computers can ... by zinekeller on Wednesday November 03, 2021 @11:40AM (#29096194)
Ironically, the most uncrackable communications today is probably diplomatic cables to enemies (like the "red phone" which is a misnomer), which uses one-time pad (technically hard drives now) encryption, mainly because they don't trust each others' encryption (or even sharing their encryption to their sworn enemy!) and cryptologists on both sides say that OT pads are perfectly uncrackable (which is true, assuming that no-one tampered the diplomatic box between i.e. the Pentagon and the Kremlin, for example).
Re:Hackers are stealing data today so quantum computers can ... by tablespoon on Wednesday November 03, 2021 @12:16PM (#29096711)
> diplomatic cables to enemies (like the "red phone" which is a misnomer), which uses one-time pad (technically hard drives now) encryption, mainly because they don't trust each others' encryption

I don't think that's quite accurate. The Wikipedia article makes it sounds like the issue was more that they didn't want to give their adversary access to their encryption technology. In this context, OTP has the advantage of being both secure and not secret.

https://en.wikipedia.org/wiki/One-time_pad#Historical_uses

> The hotline between Moscow and Washington D.C., established in 1963 after the 1962 Cuban Missile Crisis, used teleprinters protected by a commercial one-time tape system. Each country prepared the keying tapes used to encode its messages and delivered them via their embassy in the other country. A unique advantage of the OTP in this case was that neither country had to reveal more sensitive encryption methods to the other.

Re:Hackers are stealing data today so quantum computers can ... by kodah on Wednesday November 03, 2021 @11:06AM (#29095710)
API exfiltration is a common technique. One of the downsides of public APIs is that they're usually very enumerable on purpose. This leaks into how we design private APIs as well.

Others could be more traditional, like a dragnet that infiltrates common applications or exploits, then hunts for IAM credentials or a DB server.

Users checking tokens with public endpoints into repositories is also very common.

Also, the term is post-quantum cryptography. I don't think it can be declared quantum-safe or quantum-proof just yet.

Re:Hackers are stealing data today so quantum computers can ... by shapefrog on Wednesday November 03, 2021 @10:59AM (#29095618)
-----BEGIN PGP MESSAGE----- isnt exactly hard to find.

That said it is slightly harder now most email isnt flying around in clear text just waiting to be scopped up.