Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Popular dark-web hosting provider hacked, 6,500 sites down

zdnet.com

Post reply on HN
Print view View original

71–80 of 160 posts

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#71

Post by Eliezer »

taylorfinley wrote: post #66
Eliezer wrote: post #60

Earlier quoted context omitted.

Don't roll your own crypto. If that was much better encryption, everyone would be using it.

I think we all agree rolling your own crypto is dangerous, but what siliconunit described is just a one time pad. Assuming your key data is truly random and unknown to your attacker, isn't this kind of the gold standard for uncrackable cyphered communication?

If interpreted that way, storing the noise and memorizing the offset, it amounts to having a privately stored one-time pad to be used as key... with a passphrase with as many bits in it as the offset. That’s probably not a lot of bits. You are better off storing the data, encrypted with a real pass phrase, wherever you would have stored the random noise stream that is needed to read the data in any case. Don’t roll your own crypto.

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#75

Post by kryogen1c »

>a PHP zero-day vulnerability. Details about this unpatched vulnerability were known for about a month

I find this to be a very upsetting attempt at technical clickbaiting. Feels like a journalist trying to appeal to semitechnical readers with hackerman slang.

If it was known for a month, it's not an 0day.

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#76

Post by spurgu »

superkuh wrote: post #4

Man, why do people insist on using others to host their tor hidden services? It seems like the last thing you'd want or need to do. It's super simple to set up a hidden service from your home computer and host. I've been putting all my clear web sites on tor as well for years. Lots of bot traffic but never any problems and plenty of real traffic too.

If you have something that you want to be hidden you most likely don't want it to be found in your apartment.

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#77

Post by kjeetgill »

kryogen1c wrote: post #75

>a PHP zero-day vulnerability. Details about this unpatched vulnerability were known for about a month I find this to be a very upsetting attempt at technical clickbaiting. Feels like a journalist trying to appeal to semitechnical readers with hackerman slang. If it was known for a month, it's not an 0day.

Huh, doesn't making it publicly known before patching it in PHP constitute a 0day? Or by unpatched did they mean patched upstream but not here?

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#78

Post by scottlocklin »

ben509 wrote: post #54
cronix wrote: post #31

Earlier quoted context omitted.

For the same reason why the NSA siphons up all data from the net, encrypted or not, and stores it. They know one day they'll be able to crack todays crypt. Being able to decrypt a backup 5 or 10 years from now will still provide a lot of useful data, whether it came from the darknet or someones icloud backup while it was in transit to Apples servers. Encryption really only protects you from "today", not what will hap…

Quantum cryptanalysis is no help with symmetric ciphers. All the data encrypted "at rest" via symmetric ciphers, which is what companies are usually bragging about, isn't affected. Now, I'm sure there's a ton of data that the NSA will be able to break with quantum computing, because people often do transmit data by encrypting it with an asymmetric cipher, e.g. PGP. But... there's already work on quantum-proof asymmet…

Quantum cryptanalysis is no help. It doesn't exist, probably never will and people should stop pretending like it is inevitable to crank their citation count up.

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#79

Post by busterarm »

alexanderh wrote: post #44
saurik wrote: post #41

I am confused: is this seriously saying that over 30% of "hidden" services were being hosted on the server of one guy named Daniel?... that in a world where the entire point is that you don't know where anything is hosted and you are using tons of indirection through Tor to ensure there is no obvious place to hook all of the traffic or even see packets for timing attacks, it turns out there was a one in three chance…

doesn't surprise me that the initial layer of obscurity provided by TOR gave people a false sense of security.

If you want to serve some content that's illegal and someone a) offers you hosting, and b) doesn't know who you are, then you absolutely host there because it's zero risk to you.
Post reply on HN