FEDS have access to HUSHMAIL READ

[jh1]

^^^

The indicment definetly implies they read the emails between osoca and glp, and were able to subpoena the PO Box that was revealed in those emails as a result. All of which happened prior to any arrest.



BTW - You gotta have a chuckle at the Abercrombie & Fitch employment considering all the C&C fools that make fun of anyone that wears A&F.

 

[Plantro]

I haven't read as thoroughly, however I do know that to serve a warrant on a po box, an affadavit must be made indicating there is probable cause. To illegally break into an email, illegally take emails and see a random po box number and to ASSUME that money/drugs are being shipped there...simply would not be allowed into the affadavit because the email itself would need an affadavit to be hacked into to be then used as cause for issuance on the PO box.

More likely, these emails "read prior to subpoena" of the po box, were emails between a CI (FED) posing to be a client. Once 1-2 transactions are complete, THEN they have the info necessary to get at the po box...and summarily busting down his door and scaring him to death saying things such as "We know EVERYTHING about you. Give us your passphrase and cooperate and we will leave you alone, maybe you could even help us. Guys that aren't helpful face about 10 years in prison, guys who are helpful maybe just get probation. We know you spoke with GLP, let us have that passphrase and we will be on our way and contact you from time to time if we need some info."

Once that happens, they can now subpoena all old emails exchanged between osaca and other parties, and they also have the keys to decrypt them.

The real fault of hushmail seems to be holding on to transpired email conversations. If they didn't do that, there'd be no emails to dig up besides what he is dumb enough to leave in his inbox.

 

[Mavafanculo]

I beleive they may have gotten the PO Box # you refer to from communications with OSOCA where they were posing as a customer - no?

no this was a po box where he received HIS stuff from the overseas supplier (GLP). OSOCA's buyers just emailed WU info or greendot info, they never got a box number - .

If that's not the case, here's where I am at:

I am still leaning towards a keylogger.

Yup.

Brute force is a possibility, but at that level - I doubt the DEA attempts decryption via brute force. Even a trivial password would take a significant amount of time - and there is no guarantee. You may run that for weeks on end and end up no where. I would think they farm all 'cracks' out to a much more focused group like the NSA, and I sincerly doubt they get involved for such trival nonsense.

As far as a backdoor - if there was and hush was complying and conspiring - then why would the DEA seek a warrant for a break / enter and suripticiously install a keylogger in the much more important MDMA manufacturing case linked earlier? Seems ass backwards if they could simply make a phone call to hush and get the clear text - no?

The only hint that could point otherwise was that in the MDMA case they insisted upon the keylogger because they needed 'realtime' access to clear text emails - which in a hush/backdoor scenario - hush may not be setup to provide real time - they may have to retreive the emails, decrypt, send on a CD to LE.

That was my thought - getting a subpeona, serving, hush preparing and sending takes time - a key logger can transmit in real time or short-delay bursts.


How you would approach countering *ALL* these possibilities would vary depending upon if you were a customer or a distributer.

at some point, the propeller heads in the crypto community will latch on to this (or someone should make them aware) and eventually it will force a response from Hush

...

 

[Mavafanculo]

^^^

The indicment definetly implies they read the emails between osoca and glp, and were able to subpoena the PO Box that was revealed in those emails as a result. All of which happened prior to any arrest.
...

alrite, now lets go back to C&C and make fart jokes.

 

[jh1]

at some point, the propeller heads in the crypto community will latch on to this (or someone should make them aware) and eventually it will force a response from Hush

...

It's going to take industry pressure on Hush to reaffirm their system, and open portions to peer review. I've made some posts in the right places with links to the indictment, not to many peeps are biting at the moment... but there is some interest...

We'll see....

If you can get the story to page 1 on DIGG you'd be golden, with that much pseudo mainstream attention the security researchers would have to respond...

 

[Mavafanculo]

It's going to take industry pressure on Hush to reaffirm their system, and open portions to peer review. I've made some posts in the right places with links to the indictment, not to many peeps are biting at the moment... but there is some interest...

We'll see....

If you can get the story to page 1 on DIGG you'd be golden, with that much pseudo mainstream attention the security researchers would have to respond...

niceeeeeeeeeeeeee lol

 

[jh1]

niceeeeeeeeeeeeee lol

I think getting Phil Zimmermann's attention would be key. He'd be greatly offended considering how much he put into PGP. If someone can device a plan to shake him up a bit, you'd be in.

Contacting him is easy. Too easy. He gets way too much email for something from me to get his attention.

Or someone he considers his peer... Bruce Schneier, etc.

 

[Kachunga]

Thanks Digger, Mavafanculo, and jh1 for some excellent reading and aiding in lowering my bloodpressure.
Also is cyber-rights and Hush the same company?

 

[jh1]

I just talked to a crypto friend that is on a mailing list that Phil participates on regularly. He's going to post something.

Harder to ignore if others are interested and keep asking for Phil's input.

 

[jhondo]

Did you guys know that if I go onto Google earth I can see an aerial photo of your home!

Not mine. I am under a cloak of invisibility. Also, I can see you through my computer screen. Put some pants on.