
How the Catalan government uses IPFS to sidestep Spain's legal block - kilburn
http://la3.org/~kilburn/blog/catalan-government-bypass-ipfs/
======
antaviana
"Basically, the code recurses a sha256 computation 1714 times to get a lookup
key, and then once more to get a password for decryption."

This is an Easter Egg. Barcelona fell on September 11, 1714 during the War of
Spanish Succession and with that Catalonia's freedom as well. September 11 is
the National Day of Catalonia.

Also, at 17:14 of each and every game of FC Barcelona in Camp Nou Stadium,
Barcelona fans claim for independence [1].

So it was not by chance that the coder chose 1714 for the encryption
algorithm.

[1]
[https://www.youtube.com/watch?v=EneqR3oDpmQ](https://www.youtube.com/watch?v=EneqR3oDpmQ)

~~~
gfiorav
Wasn’t this the succession war between Habsburg and Borbon dynasties?

I’ve seen some depictions in paintings [1] where you can see soldiers from the
Habsburg (wearing the Catalan berretinas) porting a Spanish flag... I believe
it was more a war for two different models for Spain, not for independence or
anything like that. Sounds like revisionism to me.

[1] [http://www.msde.es/wp-content/uploads/2012/10/2-Embarque-
de-...](http://www.msde.es/wp-content/uploads/2012/10/2-Embarque-de-la-
primera-espedici%C3%B3n-de-voluntarios-catalanes-a-Cuba..jpg)

~~~
lottin
The war was between European powers and had many ramifications in different
places. For Catalonia the net result was that it lost its political
institutions and became a province in a centralised state.

~~~
faragon
Also, became a much richer region, because after the centralization got access
to world-wide trade because of the Spanish Empire.

~~~
zo1
And with that definition/benefit you've stated, how is that different to
colonialism?

~~~
faragon
Catalans were doing colonialism within the Spanish Empire. I.e. doing the
colonialism, not suffering it.

------
kilburn
Author here. I've tried to keep the article as apolitical as possible, while
giving some context to provide the setting.

Anyway, I'm very interested in knowing if the used crypto is sound or not, and
stirring a discussion around possible alternative approaches.

Ask me anything if you want to know further!

~~~
red_admiral
The crypto is far from ideal.

The situation is very similar to password storage, where you want to not make
it trivial to brute-force moderate-entropy passwords even if your database
gets breached. We have functions designed specifically for that: scrypt,
argon2 etc.
[https://www.npmjs.com/package/scryptsy](https://www.npmjs.com/package/scryptsy)
is a pure JS implementation of scrypt for example.

Even with scrypt the situation is not great, but using sha for this kind of
thing is no longer state of the art. If people are willing to (a) download and
run a program rather than rely on the browser and (b) willing to wait half a
minute or so for the result then you could easily tune the scrypt/argon
parameters up to 11 but at the cost of quite a bit in the way of usability. If
"must work on smartphones without extra app downloads" is a requirement you're
pretty limited in what you can do this way.

Another solution might be to use real servers but host them on the "dark web"
\- get Tor a bit of publicity in Catalunya!

EDIT: in response to a few posts that briefly appeared and then disappeared
again - IPFS is fine. SHA256 for authenticating a page is fine. I'm only
objecting to using raw SHA-anything as a key derivation function as in the
section "A static database".

~~~
timthelion
I'm not sure what you mean by "the crypto is not ideal"? I was under the
impression that there are not yet collisions for SHA-256
[https://github.com/ipfs/faq/issues/22](https://github.com/ipfs/faq/issues/22)

Only for SHA-1 (which has 160 bit hashes)
[https://en.wikipedia.org/wiki/SHA-1#Attacks](https://en.wikipedia.org/wiki/SHA-1#Attacks)

~~~
red_admiral
The attack mentioned on the page is brute-forcing someone's details from
partial information:

"it can be used to “fill the gaps” of information about any citizen. If you
know someone’s birth date and the area where they live, you can obtain their
government ID by trial-and-error on that website."

The mitigation is slowing down the number of guesses/second that an attacker
can try. In a well-designed key derivation function, an attacker with 100x the
resources should only be able to try out guesses 100x as fast. That's what
scrypt/argon2/bcrypt/PBKDF2/... try and achieve.

SHA and other general-purpose hash functions tend to be easy to parallelize,
at least in parts, and you can get huge speedups on GPUs or even better,
FPGAs/ASICs. That's why no-one serious still mines bitcoins on CPUs and the
big mining syndicates [hire
planes]([http://uk.businessinsider.com/cryptocurrency-miners-rent-
boe...](http://uk.businessinsider.com/cryptocurrency-miners-rent-
boeing-747s-2017-7)) to ship GPUs a little bit faster.

This has nothing to do with collisions. It's to do with hash functions being
designed to be fast, and key derivation functions are designed to be slow and
memory-hard.

~~~
samstave
Holy shit! People are hiring planes to ship them GPUs!?

Jeasus!! Gibson was far more prescient than acknowledged;

" __ _the future is already here, but not evenly distributed yet_ __"

Wow...

I had such opportunity and ability to buy bitcoins in 2012... and I missed
that boat.

~~~
rangibaby
I downloaded the Bitcoin mining app in 2010, opened it once, got bored of
waiting for it to sync with some server, then shut and forgot about it for a
few years. It might be a funny story to tell my grandkids if BTC is still
around

~~~
saimiam
If Bitcoin is around when your grandkids are of age, even this minute might be
a great time to buy Bitcoin. Why miss the same boat twice?

~~~
kebman
Hope what you say is true, because I bought bitcoin @ $4700 :'(

------
amelius
As an outsider, it's strange that nobody here seems to question whether the
referendum really makes sense.

Forgetting about Catalonia for a moment, isn't it fundamentally amoral that a
part of the country where prosperity has (by mere chance) concentrated
suddenly wants to split off? Isn't this taking wealth-inequality to the next
level?

Of course the people in a prosperous part of the country want to split off.
Absolute democracy seems to result in an undesirable situation, because do we
really want to live in a world that converges towards little selfish islands?

~~~
SapphireSun
The part that makes it even more confusing for me is that their party,
Podemos, is a real left party which you'd expect to be against increasing
income inequality.

I expect that the situation in Spain is much more complex than we give it
credit for.

[https://en.wikipedia.org/wiki/Podemos_(Spanish_political_par...](https://en.wikipedia.org/wiki/Podemos_\(Spanish_political_party\)#Policies)

EDIT: added link, changed "socialist" to "left"

~~~
gpvos
Downvoted because "their" is a very misleading word. Podemos is not
particularly Catalan.

~~~
SapphireSun
Thank you for the correction.

------
mabbo
I just left Barcelona a couple hours ago, the capital of Catalonia. Everywhere
you look, Catalan flags, signs demanding 'democracia', demanding freedom.

I'm told this is just normal for the region, but if this is normal then
independence is eventual.

~~~
pipio21
Well, it is normal since independentists have controlled Catalunya since 40
years ago. It used to be that 20% of the population was independentist
through, now is over 50%.

For example, they choosed school principals among independentist so now over
85% of them are Catalan language teachers that tend to be independentist. This
way kids could be directed to be independentist too.

The same happened with the local media, TV3, newspapers like La Vanguardia. If
you were not independent public funds were not given to you. Those private
media without the public funding could not live on their own.

Since 20 years ago they control education too, and kids are forced to speak
Catalan as the main language, studing a very biased History full of lies like
that Catalunuya was a reign in the past. They also put big sanctions on shops
labeling things on Spanish until nobody dare.

They brought nearly a million muslim people to Catalunya to work so they do
not speak Spanish, like people from Spain or South America does. This makes it
the higher terrorist risk area in all Spain, including Ceuta and Melilla.

The problem was not independentist forces doing this, but the central
gobertment that let this happen.

Now with half the population(controlling Catalunya) against the other
(supported by the Govertment) there is a significant risk of civil war there.

~~~
elecbit
A Catalan here. Quite a bad description, I think. We should remember that
Catalonia had its own language forbidden to even speak in the street for 40
years during Franco's dictatorship. Language and culture was kept alive thanks
of people keeping it in secrecy.

When "democracy" returned, some of the competences they had before the war
were returned to the government.

After 6 years of demonstrations of 2-3 million (out of 7million) asking to
hold a referendum and receiving NO to any request, it was announced and
proposed one year ago in order to agree it with Spanish government, but they
would not even discuss it. In the end the unilateral way is the only way to
hold this referendum.

Why shouldn't it be allowed to ask people's preferences? Isn't it democracy?
People who doesn't want independence can say NO. Laws should serve people's
desires, not forbid participation and opinion.

~~~
trosop
Another Catalan here, a Catalan that has lived in Italy and France.

In the dictatorship Catalan was forbidden, but now Catalan in Catalonia is the
only language used in schools (the teachers are told to only speak in that
language even to the parents, search for "immersió lingüística"), the official
buildings, hospital papers, and so on. Is this what you would call repression
or not-democracy?

Now, in Spain other languages (I am using the word languages again) are
official, and they are the language the teachers use at schools. Do you know
what they call other languages in France or Italy? _dialects_! They are not
official, of course, nor used as official languages in schools or public
buildings.

So Spain is even more democratic than Italy and France in that issue, but
people are complaining in Catalonia because of the adoctrination, and millions
of euros spent by the Catalan government. Don't fool yourself. A referendum in
a moment of maximum propaganda by the Catalan government is really democracy?

The conservative Catalan government, as the conservative Spanish government,
have a lot of cases of corruption, and since all this irrationality nobody is
talking about that. Last week _Spain_ freed two _Catalan_ politicians from the
current governing party from going to jail because of the Pretoria case, but
almost nobody mentioned that. Do you really thing this chaos is not
premeditated?

~~~
gotbeans
Catalan is a lenguage... because it is. Don' play demagogy around that

~~~
gotbeans
*[1] [https://en.m.wikipedia.org/wiki/Catalan_language](https://en.m.wikipedia.org/wiki/Catalan_language)

------
diggan
"it is nearly-impossible for any actor to block access to this content because
it is replicated around the network automatically, using peer-to-peer
encrypted connections that would be very hard to identify and block at the ISP
level. "

It's right that the connections are encrypted, but it's NOT correct to say
that content is automatically replicated (but it's a common misconception).
Instead, content who is wanted by other peers is the only content that gets
replicated. You need to explicitly "pin" content to help replicate it.

This is different from Freenet where content is indeed pushed out to other
peers in that fashion.

~~~
timthelion
You do NOT need to explicitly pin content to help replicate it. Any content
which is requested via IPFS is replicated by the daemon, up until it is GCed.
The only thing that pinning does, is prevent the content from ever being GCed

~~~
mynewtb
You make it sound like if merely accessing a resource will make my ipfs node
share it to others. Is that the case?

~~~
freshhawk
Yes, analogous to downloading a torrent. The GC is run pretty regularly by
default so you generally want to pin anything you want to keep local.

~~~
gediminas_
As far as I remember GC isn't run by default - but it could have changed

------
codewithcheese
It seems shocking that Spain a member of the EU is resorting to these tactics.
Can you discuss some of their justifications for doing so?

~~~
kilburn
The spanish constituion explicitly states that Spain is an indivisible
country. Hence, the Constituional Court (that is elected by the parliament)
has ruled out that any referendum about independence is illegal.

At this point, the government says that both them and the judiciary powers are
just defending the democratic rules, and Catalonia's government is the one at
fault for all this hassle.

The problem is that it is accepted that there's a wide majority of catalan
people who want a referendum, and here we are...

~~~
jacquesm
Governments usually do not like to give up the money making portions of their
countries and neither does the population of the rest of the country. You
never see a poor part of a country seceding (well, other than Quebec maybe).

~~~
tartuffe78
The South in the U.S. Civil War?

~~~
int_19h
The South expected massive cotton revenues to prop its economy.

[https://en.wikipedia.org/wiki/King_Cotton](https://en.wikipedia.org/wiki/King_Cotton)

~~~
QAPereo
To be fair however, it was known how the war would proceed _before_ the
outset!

In the words of General Sherman:

 _You people of the South don 't know what you are doing. This country will be
drenched in blood, and God only knows how it will end. It is all folly,
madness, a crime against civilization! You people speak so lightly of war; you
don't know what you're talking about. War is a terrible thing! You mistake,
too, the people of the North. They are a peaceable people but an earnest
people, and they will fight, too. They are not going to let this country be
destroyed without a mighty effort to save it… Besides, where are your men and
appliances of war to contend against them? The North can make a steam engine,
locomotive, or railway car; hardly a yard of cloth or pair of shoes can you
make. You are rushing into war with one of the most powerful, ingeniously
mechanical, and determined people on Earth — right at your doors. You are
bound to fail. Only in your spirit and determination are you prepared for war.
In all else you are totally unprepared, with a bad cause to start with. At
first you will make headway, but as your limited resources begin to fail, shut
out from the markets of Europe as you will be, your cause will begin to wane.
If your people will but stop and think, they must see in the end that you will
surely fail._

People are not rational however, and the wealthy landowners were facing the
extinction of their wealth... so they started a war.

~~~
sampo
> the wealthy landowners were facing the extinction of their wealth... so they
> started a war

As someone who doesn't know much about American history: What happened to the
wealth of those Southern landowners after the war? Did they get to keep it?

~~~
logfromblammo
Some of it. Many of those who survived lost a good portion of their capital.
But they kept title to their land, and used that leverage, voting power, and
racist solidarity over time to claw back much of what they had previously
enjoyed from exploitation of the emancipated slaves.

The South was still devastated by the war. But being largely agrarian to begin
with, loss of capital wasn't quite as hard a blow as losing a factory.

------
marcoperaza
It doesn't matter that they can circumvent it. The fact that the Spanish
government has taken such drastic actions means that the result of the vote
will be completely meaningless and illegitimate. Opponents of the referendum
who agree with the Spanish government will not participate.

~~~
farresito
The reason referendums don't have a minimum of votes is precisely to avoid
boicots like the one that the opposition is trying to do, so if they don't
want to vote it's up to them, but that doesn't make the referendum any less
valid.

~~~
jknz
If the referendum unlawful, then some people will not go to vote, simply
because they usually avoid breaking the law.

The result would be valid (from a probabilistic point of view) if "going to
vote" was independent of "voting yes". But if the there is any correlation
between "going to vote" and "voting yes" then the result of the referendum
will be significantly different than the result of a referendum where any
individual was forced to vote.

Here there might be a correlation: people in favor or independence or more
likely to go voting than others.

A similar phenomenon may have happened in the us. If there is a correlation
between "lying to polls" and "voting for candidate A" then the poll
predictions can become very wrong.

------
humblebee
"it is nearly-impossible for any actor to block access to this content because
it is replicated around the network automatically"

This isn't entirely accurate though. It's only replicated if people request
it. If everyone only requests the content through `ipfs.io` then the content
will only be living on the original seeder, and the IPFS gateway nodes which
run GC on a regular basis.

Depending on how the content is moved, it _might_ end up on a few other nodes
(a way around nats, by using a third party peer to stream content between two
peers), but I believe it's only ever moved through the network, and will not
be stored on the nodes. If it is, it's only there till the next GC (disabled
by default I believe).

------
geofft
Wow, this is super cool that they thought of / implemented this.

(I think your math on bits is wrong: I'm getting that log2(10 __10 * 23 * 365
* 4) = 33.4, not 28.)

A few notes on the crypto off the top of my head:

1\. 1714 iterations of SHA-256 seems really low given that you're going to be
looking this up approximately once per person. My 2010-era laptop can compute
about a million hashes per second according to `openssl speed sha256`. A
second or two to look this up is definitely comparable with what a human would
expect the UX to be for a dynamic website run by a government; honestly I
wouldn't complain about up to a _minute_ as long as there was a clear progress
bar. So you could easily change it from 1,714 hashes to 1,714,000 without
impacting UX, and you should probably do that given the relatively small key
space, which would give you a factor of 1000x on the brute force attack.

2\. AES-256-CBC with no IV smells funny to me. I guess every message is
encrypted with a different key, but the keys _themselves_ are easily derivable
(they're just a single SHA-256 hash of the lookup key, and those are all in
the public filesystem). I cannot think immediately of an attack against this
but maybe someone else can.

3\. Your brute-force estimates are what's needed to enumerate the entire
lookup key space. The practical attack here is what you've outlined, that you
know someone's date of birth and zip code (which are likely in public
records). and want their national ID for some identity theft. You're not
trying to find some arbitrary person to steal the identity of. That means that
the date of birth and zip code are fixed, and you only need to brute-force the
DNI portion, which has only 10^5 * 23 possibilities. That's extremely
realistic: I can compute 10^5 * 23 * 1715 hashes _on my 2010 laptop_ in a
little over an hour.

I guess they do the right thing by only using a part of the DNI string, so you
still have three unknown decimal digits, and zero information about what they
might be.

~~~
kilburn
> (I think your math on bits is wrong: I'm getting that log2(1010 * 23 * 365 *
> 4) = 33.4, not 28.)

1\. Totally right that I'm wrong, but I'm now getting 48 bits, not 33 ;)

2\. That was a terrible mistake of my own. The lookup key is derived from the
password, not the other way around. I've corrected the article to clarify
that!

3\. Yeah that's why I said you can do it with your laptop and not too much
time ;)

Only using the latest part of the DNI is not that good though. The letter is
actually a control character, which can be computed from the 8 numbers. Hence,
if you have 5 numbers and the letter, there are only some possible 3-digit
prefixes that lead to a valid DNI! How many? I would have to investigate
further hehe...

~~~
rrobukef
I can't check, but isn't sha256_times(passkey, 1713) == passkey?
(sha256_times(sha256(a), 1713) == sha256_times(a,1714)?) The encryption is
then basically worthless if you have a list of all lookups. (I didn't see a
dynamic in the sha256_times function.)

------
mtgx
I hope Mozilla shows leadership in adopting IPFS support in Firefox. I don't
necessarily want it to adopt IPFS _right now_ , but it should have a plan for
when it thinks the project is "mature enough" to be adopted in a mainstream
browser, but also it should be early enough that Firefox is the first to do
it.

Maybe Mozilla should even get involved early in IPFS so that it can shape the
protocols the way it would prefer them to work in its browser later on (while
still ensuring the censorship-resistance vision of the project remains
intact).

~~~
clarry
Should they also adopt Tor, Freenet, I2P, etc.?

But I would give a thumbs up for Gopher support.

~~~
timthelion
I would hope they adopt Tor at some point. That would be awesome. Why
shouldn't they?

~~~
dna_polymerase
Why _should_ they? Tor is managed by the Tor Project. It is bundled & shipped
as TBB already, using Firefox. You already can use it if you want to, so why
would they bother with implementing Tor in the mainstream version of Firefox?
They could only offer it as option (because not everyone wants to use Tor all
the time) and this option is already satisfied.

~~~
timthelion
So that it is more accessible to "normal" people and so that onion links would
"just work"

------
jarofgreen
"In the where to vote? page, you are prompted to enter some of your details:
DNI (national id), Birth date, Zip code"

Wait a second, can someone from the area explain this? Why on earth do they
need your ID number just to tell you where to vote?

In my country (UK) 99% of the time all you need is a postcode and you can be
told your voting place. (I say 99% because there are a few postcodes that are
split across different seats and thus different people in the same post code
have different polling places. Also just to note some areas are bad at
publicly supplying this data. But my general point still stands.)

~~~
kilburn
For most people that would suffice, but there are exceptions: people who moved
recently, people who is not accounted for, etc..

This way, if you are not in the database you know that there's a problem and
can ask the authorities to get it fixed before it is too late and you cannot
vote.

~~~
jarofgreen
That's a different question tho - what your talking about is "Am I registered
to vote correctly?" and there is no way to answer that without a DB of
personal information in some way.

(This could be handled better in the UK - at the recent election there was a
website for last minute registrations which got lots of traffic, and
afterwards they said a very large amount of people were already registered.
But there is no easy system to check if you are already registered .... so
everyone just used this site to sign up again.)

BUT

The article talks about answering the question "Where do I vote?". The
assumption is the registration is correct, you just want to know where to
vote.

In my country, this can be answered by a information system that contains no
personal information at all, so I was surprised to see the DOB & ID bit in the
original post.

------
StavrosK
Ah, that explains why I saw various catalán sites being pinned on the IPFS
pinning service I run ([https://www.eternum.io](https://www.eternum.io)),
which also runs a public writable gateway (so you can access IPFS files,
including the banned catalán websites, through it).

Having just gotten back from Barcelona, I have to say that the way the Spanish
government is handling this is far from ideal. I don't very much support the
Catalonian plea for independence (I haven't heard any good reasons other than
"but our freedom"), but blocking sites seems... suboptimal.

As for the crypto itself, why not use bcrypt? Your users don't care if it
takes three seconds, but it makes attacks entirely infeasible.

~~~
NetStrikeForce
Do you mind technically explaining a bit more about pinning, how it works and
why would anyone do it?

~~~
TheLugal
You can't just look at data from the internet without touching it, you need to
download it. The same holds true when reading data from the IPFS network.

In the process, you make it available for anyone else who ask for it, but only
for a limited time; until the Garbage Collector (GC) runs. If I remember
correctly, the GC run once every hour or so, so you probably won't reshare the
data for longer than that.

You need to pin the data if you want to keep resharing it. This effectively
tells the GC to not touch it.

~~~
NetStrikeForce
That was very clear, thanks!

~~~
StavrosK
You can kind of think of it like seeding a torrent, and pinning ensures the
seeding won't stop until you unpin.

~~~
NetStrikeForce
So the service would be the equivalent of a seedbox?

------
krab
I don't understand why would you need to know a person's details to tell where
he should vote. In Czech Republic, you can tell just from your address of
residency. It's usually the closest one to your registered address. Therefore,
it should be enough to publish just the list of locations and the areas they
serve.

------
Opossum
For those who want more background into what's going on, here is an excellent
video from The Economist explaining the independence movement in Catalonia:
[https://www.youtube.com/watch?v=NaQ4_v0fz6k](https://www.youtube.com/watch?v=NaQ4_v0fz6k)

------
c3534l
If my government did that, I'd certainly want independence, too.

------
ismaelmartinez
Agree they should have not use a bespoke algorithm but I don't think there is
much of a security issue. Knowing where you need to go to vote is not enough
to vote.

You still need the physical security of the ID (DNI) that includes a few
security features (like your face). You can see and image here:
[http://www.aulaclic.es/articulos/graficos/DNIe.gif](http://www.aulaclic.es/articulos/graficos/DNIe.gif)

From my point of view, this rises a far more interesting question.

Do you guys think it could be possible to use blockchain to implement a secure
voting system? I do and I got a few ideas about the main issues
(authentication, authorisation, validity period and others) and will be happy
to discuss with anyone interested on co-developing such a system... or if you
know of one already do let me know!

Seems like if every computer can be a "poling station", authoritarian
regimes/governments will have a more difficult way of stopping this sort of
voting from happening. And maybe, only maybe, we can enjoy a free democracy.

------
reeffflio
I'm genuinely curious which part ipfs solves here? Given that it's still
accessed via browser/domain wouldn't they just block the dns or even ip? In
which case this is no more resilient than say multiple domains and dns entries
and proxying on from there to a central database (which could be run in a
jurisdiction over which Spain has little control and which they would have to
discover first anyways)

~~~
TheLugal
Data on IPFS is accessed over P2P, not over IP. ipfs.io is just running a
gateway. Anyone could do that. In fact; if you were to run IPFS on your
computer, you'd probably have your own gateway on your localhost.

Somebody would just make their own public gateway, and the government would
need to block another domain. Of cource, running IPFS for yourself would take
away any need to use a gateway.

------
ahachete
Let's get the political reasoning straight.

Under Spanish Constitution, supreme law in Spain, the right to determine the
territory of Spain belongs to _all_ Spaniards (article 2).

What some people claim as "democracy" or "the right to vote" is actually
removing this right from the rest of Spaniards.

Aside from other claims and whether there are political or historical reasons,
the voting has been declared illegal by the "Tribunal Constitucional", highest
court in Spain. End of story, it's illegal, period. And Spain (mostly judges
and police forces) are trying to defend the law.

Now a quick note on the alleged economical facts: no, Catalonia does not
contribute 16 billion to the rest of the country, it's actually 2,4 billion
(this is what Catalonia published last year). This is called "solidarity", and
it is what contributes to other regions in Spain to grow and benefit the
country as a whole. Madrid is also a significant net contributor. On the other
hand, Spain holds 55 billion in debt from Catalonia, which is unable to
finance by itself on international debt markets. So numbers don't add that
quickly as it has been said here.

~~~
edko
Let me add one thing: the current Spanish Constitution was subject to a
referendum in 1978. In Catalonia, it was approved by 90.46% of the votes.

~~~
adventured
1978, shortly after the dictatorship ended, a time in which Spain was still
dominated by cronies from that very dictatorship, and who proceeded to dictate
the Constitution.

So in 1978 Catalonia's vote mattered and you're claiming today it does not.

~~~
ahachete
Because it did matter in 1978, there's a law that says that 1-O voting cannot
happen, it's illegal.

Only all Spaniards can vote regarding the integrity and sovereignty of Spain.

If you think 1978's Constitution was approved under some form of oppression,
fight that, there are clear ways to change the Constitution. But do not
support any illegal activities that remove rights from the rest of the people
in the country.

The root of the democracy is the respect to the law. Not "voting".

------
vicenteherrera
The original article doesn't take into account that DNI letter is calculated
from the previous DNI digits with a known formula. So when you choose the
numbers, you already know the letter. See for example:
[https://gist.github.com/afgomez/5691823](https://gist.github.com/afgomez/5691823)

So Instead of: 10^10 * 23 * 365 * 4 = 33580 * 10^10 possible combinations , we
have 10^10 * 365 * 4 = 1460 * 10^10. And we can represent it with 44 bits
instead of 48.

To explore all possible combinations, we need then 1460 * 10^10 * 1715 = 25039
* 10^12 hashes, instead of 575897 * 10^12 hashes

With AntMiner S9, we can do all hashes in: 25039 * 10^12 / 28 * 10^9 = 10.3
days.

If we want to specifically scam a target neighbourhood (imagine sending an
email telling people "your local bank in your neighborhood asks you to reset
your password), we can choose a fixed zip code, and all this could be guessed
with a less powerfull machine (someone else can do the math).

------
sexydefinesher
How very crypto-anarchistic

~~~
jsdario
Seems more accurate to say crypto-nationalistic

~~~
QML
crypto-separatist

------
m-p-3
How does one provide a full mirror/node of an IPFS website? I wouldn't mind
sparing some bandwidth and storage.

~~~
lindner
First install ipfs

then run:

    
    
      ipfs pin add QmZxWEBJBVkGDGaKdYPQUXX4KC5TCWbvuR4iYZrTML8XCR
    

and wait for a large amount of data to be pulled in....

~~~
m-p-3
Thanks, will do that!

------
jaimebuelta
Wow, the potential massive leak of private information this could lead to
seems quite irresponsible...

------
blueyes
It's interesting how Russia and Assange are backing every movement that
weakens the West (Trump, Brexit, and now this):

[http://www.businessinsider.com/julian-assange-catalonia-
inde...](http://www.businessinsider.com/julian-assange-catalonia-independence-
movement-and-referendum-spain-2017-9)

Russia wants to break apart the bloc with Germany at the center to dominate
its neighbors. It's a replay of Russia's tensions with Europe that date at
least to the Napoleonic wars, and include WWI and WWII.

------
agl
"Basically, the code recurses a sha256 computation 1714 times to get a lookup
key, and then once more to get a password for decryption."

Other way around, no? The index is the hash of the decryption key (as it
should be), it's just that the index is called "key" and the key is called
"lookup".

If the decryption key was the hash of the index, then it would be trivial to
decrypt every entry.

~~~
kilburn
You are right, and I made a huge blunder while "prettifying" the code and then
commenting it. It should be corrected now!

------
bartolo2
I would have used scrypt (memory bound and therefore hardly scalable in
ASICs/FPGAs) with a higher round count, say that it takes ~1s to calculate the
hash. That way bruteforce is infeasible these days. Also I would have used
other sparse information such as street number that hardly can be connected to
a particular person.

------
enriquto
Summary of instructions to add a ipfs node for this site :

    
    
      wget https://dist.ipfs.io/go-ipfs/v0.4.11/go-ipfs_v0.4.11_linux-amd64.tar.gz
      tar zxf go-ipfs_v0.4.11_linux-amd64.tar.gz
      cd go-ipfs
      ./ipfs daemon &
      ./ipfs pin add QmZxWEBJBVkGDGaKdYPQUXX4KC5TCWbvuR4iYZrTML8XCR
    

The stuff goes into ~/.ipfs

------
multibit
"it is nearly-impossible for any actor to block access to this content because
it is replicated around the network automatically, using peer-to-peer
encrypted connections that would be very hard to identify and block at the ISP
level. Maybe China could do it, but Spain definitely cannot."

How would China do it?

~~~
pyre
I imagine because China has spent more time on the required infrastructure to
make this happen. Spain is trying to stop something that is set to happen on
Oct 1, so they have a finite amount of time to suppress the information.

~~~
JBReefer
By the same token, they're also not the home of a bunch of friendly companies
that will implement the work, unlike China, and they don't have a long history
of trying to stop the flow of information, unlike China, and they don't have a
effectively infinite budget, unlike China.

I'm betting against Spain on this one. Go Catalonia!

~~~
rocqua
There is a huge gap between having a referendum on independence and actually
being independent.

------
frabbit
Good historical perspective: [https://www.jacobinmag.com/2017/09/catalonia-
independence-re...](https://www.jacobinmag.com/2017/09/catalonia-independence-
referendum-spain-podemos)

------
tammer
I see IPFS as the single most promising & important software projects in the
world today.

------
utnick
A possibly simpler solution would be to not have assigned places to vote that
are based on your ID & DOB.

Just vote at the polling place most convenient to you, and announce available
polling places on posters around town, or facebook & twitter if you prefer.

~~~
euyyn
The reason that isn't done in any election is because, to prevent people from
voting twice, each voting station needs a list of the people that are supposed
to vote there.

~~~
jarofgreen
That's a fair point but doesn't explain why ID & DOB are needed. I asked about
this in another comment - in my country, you just need your postcode to find
your polling place 99% of the time.

~~~
NetStrikeForce
It's needed because it depend on the census.

In Spain you don't have to register to vote every time. Just show up at the
place you have to, based on the census.

~~~
jarofgreen
Interesting, but that doesn't answer my question. It's not in any way about
voter registration.

I'm asking why can't you be told where to vote - the original thing the
article is about - based on your postcode only. But I think I have my answer
in another thread.

------
h4sh3r
I have done: ipfssudo get QmQZzfs7LjkEnmG3zU92YF7ViCcuCXkNokuYoiNe6pKvDZ

But I don't see any database only html code, how can I clone this website to
see what is happening with my f __* data?

------
ceene
The letter in the DNI is a checksum of the numbers. Simply DNI mod 23 indexes
a lookup table with the 23 allowed letters, so those 238 card days get reduced
to only 10 days!

------
mola
Is there oppression of human rights by the central government? Is there
discrimination against catalans ? In other words, what's broken that secession
would fix?

------
cJ0th
Some interesting insights there. Thanks for this article. I just hope this
doesn't lead to more draconian IT laws all over the EU... ;)

------
daniel_wolves
[https://youtu.be/6Ggi_QPYRrA](https://youtu.be/6Ggi_QPYRrA)

------
yk
Hmm, it appears I have misplaced my mirrorshades. I mean it's really bright in
the future.

~~~
wyager
A healthy dose of Gibson and Stephenson helps me to stay sane. It feels like
we're approaching a singularity.

------
baxtr
I really wonder why we have such a hard time to get along with each other...

------
themihai
What if ipfs.io goes down? The DNS has always been the bottleneck.

~~~
aoeusnth1
Spray paint 8.8.8.8 on buildings.

~~~
Asdfbla
Government could probably just block any DNS requests that want to resolve the
ipfs.io domain. Though Spain probably does not have the censorship
infrastructure deployed for that the way a country like China has.

~~~
contravariant
Spray paint the IP of ipfs.io?

For reference it's 147.135.130.181. Or if you want to go to the Catalan
referendum page, it's
[http://147.135.130.181/ipns/QmZxWEBJBVkGDGaKdYPQUXX4KC5TCWbv...](http://147.135.130.181/ipns/QmZxWEBJBVkGDGaKdYPQUXX4KC5TCWbvuR4iYZrTML8XCR/en/index.html).
Unfortunately SSL doesn't work, as the certificate is only valid on ipfs.io.

------
CaiGengYang
Why does a single post like this get 479 points (so many) ?

------
sabujp
kurdistan, quebec, and california up next

------
teknopaul
All seems rather like an arms race.

------
jsdario
Voting is not necessarily democratic. Hitler won in democracy. Respecting
minorities and not playing the victim card is more democratic indeed! There
are many republicans dead under catalan descending military charges, all over
the peninsula. I don't think being born in Catalonia makes you less fascist.

But you can always play the victim card ans act like history never happened.

