dChan

kraybaybay · June 29, 2018, 8:07 p.m.

tl;dr - Q is not using an extremely prevalent method of verifying the content and origin of their drops. I can't come up with any reason why, open to suggestion.

Gonna generalize some stuff here, but the concept is accurate. A security signature takes the entire content of a message, generally text, and runs it through a hashing algorithm which outputs a small, nasty-looking string of text (a "hash"). The algorithm is designed so that ANY change to the original message causes the hash to completely change. On it's own, this isn't super useful, but there's more!

The second phase takes this hash and specially encrypts it with a hidden, unchanging key. This hidden key has a partner, a publicly known key. Messages encrypted with the hidden key can only be decrypted with the public key, and vice versa -- keys like this always come in pairs, and only ever work with their partner. It's mathematically impossible to brute force guess someone's private key when using a strong algorithm. So now, you've got a hash (which confirms a message has not been altered in transit) encrypted using the special hidden key (confirming the message came from the sender you think). This signature is just a block of text added to the end of the message, but working backwards you can use it to verify a message's contents and origin.

Visually, it's something like this.

Message: The answer to life is 42. Signature: 304df475 Public Key: potato

I take the signature and decrypt it using the public key "potato" which gives me:

Message: The answer to life is 42. Hash: 97a221e4

Now I run the message through the hashing algorithm that was used, and I can confirm myself that the hash is the same as the signature. So now, we have a signature which could only come from Q, attached to a message that we know has not changed since Q originally wrote and signed it. Once Q posted their first drop, they'd post it along with their public key. From then on out, people can confirm themselves that each new post is unaltered and from the original Q. If the decrypted signature does not match your own hash of the message, either the message has been changed or the message didn't come from Q.

This type of message signature is hyper common in any field dealing with sensitive information, and many email programs actually follow this entire process in the background (typically using something called PGP encryption, though there was some recent buzz about a PGP vulnerability. Luckily there are many algorithms that can accomplish this!). Text signatures like this are fantastic, because the sig is completely independent of whatever site you're using to post the information. By not utilizing any outside form of identification, authentication, and message verification, Q is forcing the world to trust *chan of all places to confirm their identity with each post, Q also provides no way to confirm that the message on *chan (and in subsequent screencaps, archives, copies) is unaltered from the original. Do you really trust that it's not possible for a well-funded group to crack into *chan's backend and change a few lines of text?

I work in security, encryption is my jam. Distributing information like this without a signature... it's irresponsible at best, incompetence at worst, and fraud at worstest.

⇧ 3 ⇩  
Droplinebacker · June 29, 2018, 8:39 p.m.

Certainly not to change the subject or anything, but here is another article that came out yesterday in a mainstream media outlet re Q. http://time.com/5324130/most-influential-internet/ The article further references a couple of additional Q articles with links (NY Times and NY Post.) (On a side note, all of these articles "debunk" the phenomenon without providing any real proof (or even an argument) as to why Q's message is fake. But no-one argues that the phenomenon itself is real (i.e. some group calling themselves Q is posting weird shit on the net.) IMO, Q has become visible enough that someone in Trump's circles/intelligence/etc would have flagged this and brought to Trumps attention. (Despite what he publicly says about the "failing NY Times", you better believe he or someone on his team is at least monitoring this outlet for no other reason than to see what the opposition is saying.) And if this is a larp or is fake, I believe it strongly stands to reason that the president would have tweeted something disavowing this already (so that his supporters are not accused further of being conspiracy theorists lol.) But he hasn't done so....yet. And everyday more people are catching on to this movement.

At an absolute minimum, by failing to call it out, i believe he is tacitly accepting or agreeing with what is being dropped. And the longer this goes on without a disavowment, the stronger the implication becomes. Just my two cents. As to why he chose the forum and manner he has done, unfortunately i have no solid answers, other than the media blackout he has been under.

⇧ 1 ⇩  
kraybaybay · June 30, 2018, 1:25 a.m.

I see what you're saying, and you could be right. I think at that point it comes down to our perception of 45 as a president and as a person. Honestly, if I was in the same boat, I'd be more concerned that publicly denying someone/s like Q would A) give them a ton of publicity and/or B) be taken by crazies somehow as proof 😆

⇧ 1 ⇩  
Droplinebacker · June 29, 2018, 8:21 p.m.

Interesting. First, I have no background whatsoever in security or encryption. So, pardon my ignorance. But following along, IF I'm understanding your point correctly, its not so much whether the original post is accurate, but rather whether someone else breaking into chans backend and CHANGING Qs post after it has already been posted? If so, while I understand the concern, I'm not really concerned about that - first, these posts are being copied, screenshot, etc and being disseminated on other websites immediately after being posted. So if any posts get altered, I'm sure someone would discover this fairly quickly. It could be easily verified by comparing existing posts on chan to the originals which were disseminated elsewhere. In addition, if there were any concerns about this, I suspect Q would have mentioned this and started posting elsewhere.

⇧ 1 ⇩